sbt: baixar versions anteriors

🐛 bug fixes
- fix: Fix AccessDeniedException writing SemanticDB by @eed3si9n in #9878
- fix: Fixes .m2/settings.xml overriding sbtResolvers by @eed3si9n in #9828
- fix: Keep accepting after a client fails by @kitbellew in #9691
- fix: Fix task output lost by the thin client under CPU load by @eed3si9n in #9868
- fix: Read all forked test output before reporting the fork's exit by @eugkhp in #9860
- fix: Use Path.userHome to work around user.home returning ? by @eed3si9n in #9866
- fix: Fail a gRPC batch read when a blob fails by @eugkhp in #9904
- fix: Fix pipelined compile hanging when compile inputs fail by @jleider in #9896
- fix: Workaround compiler-interface eviction when depending on the remote cache plugin by @eed3si9n in #9913
- Make logging robust against closed sbtn by @eed3si9n in #9911
- fix: Fix BSP connection getting dropped by @eed3si9n in #9911
behind the scenes
- Update mima setting by @eed3si9n in #9869
Full Changelog: v2.0.10...v2.0.11

changes with compatibility implications
- sbt runner script honors JAVA_HOME environment variable by @anatoliykmetyuk in #9825
🚀 updates
- deps: Updates to Coursier 2.1.26, and sets user agent header by @eed3si9n in #9784, #9852, #9786 and #9818
🐛 bug fixes
- fix: Removes write permission from the CAS to prevent cache corruption by @eed3si9n in #9847
- fix: Implements copy-on-write for symlinks by @eed3si9n in sbt/io#568
- fix: Restores the pipelining early output on an action-cache hit by @PhoenixmitX in #9793
- fix: Reads scripted pause from standard input by @anatoliykmetyuk in #9824
- fix: Keeps the interrupt flag when writing to the thin client by @pierscin and @eed3si9n in #9848 / #9855
behind the scenes
- deps: Updates to Gigahorse 0.9.6 by @eed3si9n in #9775
- deps: IO 1.13.4 by @eed3si9n in #9847
- deps: sbtn 2.1.0-6eac8efa by @eed3si9n in #9861
Full Changelog: v2.0.9...v2.0.10

🐛 bug fixes
- fix: Fixes AccessDeniedException on Windows by creating JAR in situ by @eed3si9n in sbt/io#558
- fix: Fixes unhermetic semanticdbTargetRoot in the compile cache key by @christianharrington in #9711
- fix: Fixes pipelined build with Java sources by @anatoliykmetyuk in #9574
- fix: Keep macro subprojects off the pipelined classpath by @stasimus in #9719
- fix: Fixes sbt runner script not starting on openSUSE by @alexasl in #9753
- Update to sbtn 2.1.0-M1 #9755
Full Changelog: v2.0.8...v2.0.9

🐛 bug fixes
- fix: Fixes ThisBuild-scoped bare settings by @eed3si9n in #9674
- fix: Fixes TestReportListener not receiving endGroup after a LinkageError by @unkarjedy in #9667
- fix: Fixes the ability to extend TestResultLogger by @unkarjedy in #9655
- fix: Fixes --addPluginSbtFile getting lost after reboot by @azdrojowa123 in #9669
- fix: Fixes JDK 17 domain socket deadlocks by @eed3si9n in #9671
- fix: Keep adhoc test classloader open in a forked test @stasimus in #9639
- fix: Fixes Windows runner by @eed3si9n in #9680
Full Changelog: v2.0.7...v2.0.8

⚠️ Remote code execution vulnerability fix
sbt team received a security report GHSA-943m-f264-54p4 from @stasimus that when the serverConnectionType is set to Tcp, an attacker is able to execute arbitrary code remotely via BSP, similar to a recent bug that was found in JSON-RPC. sbt 1.13.0 and 2.0.7 fix this bug.
Builds with the default serverConnectionType are not affected. In affected builds, we recommend removing the serverConnectionType setting, or upgrading to a patched version or later. In an affected build, the setting might look like this:
Global / serverConnectionType := ConnectionType.Tcp
The remediation was implemented by @stasimus.
🚀 updates
- perf: Stop re-converting the classpath in compileOptions by @hoangmaihuy in #9622
🐛 bug fixes
- fix: Guard diskcache against path traversal by @eed3si9n in #9605
- fix: Name the platform in CrossVersion(module, scalaModuleInfo) by @kitbellew in #9620
- fix: Avoid rewriting unchanged plugin descriptors by @unkarjedy in #9624
- fix: Fixes scalacOptions in BSP using VirtualFileRef by @azdrojowa123 in #9610
- fix: Fixes -V parsing in sbt runners by @anatoliykmetyuk in #9626
- fix: Fixes filesystem traversal order affecting cache stability by @christianharrington in #9646
behind the scenes
- ci: Remove cla-checker v1 by @eed3si9n in #9571
- Update sbtn to 2.0.0-8753a981 by @eed3si9n in #9630
Full Changelog: v2.0.6...v2.0.7

Remote code execution vulnerability fix
sbt team received a security report GHSA-m2pw-22cj-jq4v from @arpitjain099 that when the serverConnectionType is set to Tcp, an attacker is able to execute arbitrary code remotely via the sbt server. sbt 1.12.15 and 2.0.6 fix this bug.
We recommend removing the serverConnectionType setting, or upgrading to a patched version or later:
Global / serverConnectionType := ConnectionType.Tcp
The remediation was implemented by @eed3si9n and @anatoliykmetyuk.
🐛 bug fixes
- fix: Preserve file timestamp in local disk cache by @eed3si9n in #9559
🚀 updates
- perf: Improve update task by caching file hashes by @takayahilton in #9559
Full Changelog: v2.0.5...v2.0.6

changes with compatibility implications
- fix: Changes the test ClassLoader to close by default, to fix AccessDeniedException by @eed3si9n in #9538. Set closeClassLoaders to false to opt out, or Test / fork := true to fork the tests that does not shutdown properly.
🐛 bug fixes
- fix: Fixes a/build.sbt setting leakage by @eed3si9n in #9519
- fix: Fixes sbt runner failing to start sbtn on Windows by @ColOfAbRiX in #9520
- fix: Fixes forked run baseDirectory by @eed3si9n in #9531
- fix: Fixes remote cache header values with = by @KilianSwissborg in #9534
- fix: Fixes pipelined build deadlocks by @BrianHotopp in #9542
🚀 updates
- perf: Improve update performance by fixing projectCache by @hoangmaihuy in #9522
- perf: Improve update performance by avoiding artifact content hashing by @hoangmaihuy in #9524
- sbtn 2.0.0-731e6666 by @eed3si9n in #9545
Full Changelog: v2.0.4...v2.0.5

changes with compatibility implications
- fix: Forked run uses working directory by @jozanek in #9442
🐛 bug fixes
- fix: Fixes test ClassLoader retention issues by @kevin-lee in #9485
- fix: Fixes common settings with a plugin with extraProjects by @eed3si9n in #9495
- fix: Fixes dependency tree rendering on some libraries by @anatoliykmetyuk in #9371
- fix: Fixes tests not detecting stale resources by @eed3si9n in #9469
- fix: Fixes sbtn not propagating -java-home by @BrianHotopp in #9448
- fix: Fixes clean task not cleaning sona-staging by @eed3si9n in #9479
- fix: Fixes reboot from sbtn by @BrianHotopp in #9497
🐛 caching related bug fixes
- fix: Fixes hashes for directories in MappedVirtualFile by @raboof in sbt/zinc#1747
- fix: Fixes Def.declareOutput invoked in a loop by @BrianHotopp in #9492
- fix: Fixes partial cache restoration by @stasimus in #9488
- fix: Fixes system errors getting cached as compilation errors by @BrianHotopp in #9464
- fix: Improves cache restoration when the expected outputs are missing by @BrianHotopp in #9473
- fix: Fixes gRPC channels recreated on reload by @eed3si9n in #9502
- fix: Fixes scalaCompilerBridgeBin task leaking project name by @eed3si9n in #9506
- refactor: Separate file I/O from cache-write serialization by @BrianHotopp in #9496
🚀 updates
- feat: Skip checksum generation for *.asc file during publishing by @eed3si9n in #9499
- feat: Move compiler bridge to update by @eed3si9n in #8836
- feat: Allow opt-out of transient warning by @eed3si9n in #9437
- perf: Intern directory item conversions in MappedFileConverter by @hoangmaihuy in sbt/zinc#1751
- perf: Intern analysis values while deserializing by @hoangmaihuy in sbt/zinc#1754
behind the scenes
- Update Zinc to 2.0.4 by @eed3si9n in #9508
- Update sbtn to 2.0.0-a0c4773a by eed3si9n in #9503
Full Changelog: v2.0.3...v2.0.4

🐛 bug fixes
- fix: Fixes packager cache by @raboof in sbt/ivy#57
- deps: sjson-new 0.15.1 by @eed3si9n in #9458
- fix: Fixes JVM option capability in the launcher config by @anatoliykmetyuk in #9452
Full Changelog: v2.0.2...v2.0.3

🐛 bug fixes
- fix: Fixes remote cache ByteStream timeout by @yhefamly in #9413
- fix: Fixes metabuild dependency downgrade via plugin by @anatoliykmetyuk in #9426
- fix: Fixes build pipelining by @anatoliykmetyuk in #9425
- fix: Fixes auto import of givens by @xuwei-k in #9409
- fix: Fixes sbtn stdout relaying by @BrianHotopp in #9411 / #9414
- fix: Fixes shutdownall in sbt runner by @eed3si9n in #9435
- fix: Fixes attribute string in pom.xml to be deterministic @raboof in sbt/ivy#51
- fix: Fixes ivyless publishing of sbt plugins by @anatoliykmetyuk in #9416
updates
- Deprecate url(...) and Resolver.url(...) in favor of uri(...) by @eed3si9n in #9420
- Tweak server startup message by @eed3si9n in #9429
- ipcsocket 1.8.0 by @eed3si9n in #9436
behind the scenes
- ivy 2.3.0-sbt-939a7ea82f140cdb1f51dc404bb43e00a8c43b83 by @eed3si9n in #9423
- test: scala-dyn-version working again by @eed3si9n in #9438
- sbtn 2.0.0-b4d628dd by @eed3si9n in #9443
Full Changelog: v2.0.1...v2.0.2

🐛 bug fixes
- fix: Fixes sbt runner parsing build.properties with whitespaces by @anatoliykmetyuk in #9374
- fix: Fixes global plugin loading by @eed3si9n in #9391 / #9380
- fix: Fixes sbt runner support on OpenBSD by @eed3si9n in #9394
- fix: Fixes --allow-empty and --sbt-create by @anatoliykmetyuk in #9370
- fix: Fixes BSP publishDiagnostics propagation by @anatoliykmetyuk in #9376
- fix: Fixes macro expansion for higher-kinded type arguments by @tanishiking in #9377
- fix: Fixes IllegalAccessError analyzing Java compiled with --add-exports by @jozanek in sbt/zinc#1714 / sbt/zinc#1729
- fix: Fixes incremental compilation of inlined constants in Java by @jozanek in sbt/zinc#1721
- fix: Fixes incremental compilation of Java annotation usage by @jozanek in sbt/zinc#1722
- fix: Fixes incremental compilation of transitive Java super types by @jozanek in sbt/zinc#1732
🚀 updates
- perf: Update Coursier to version 2.1.25-M26 by @retronym in #9382
- perf: Improves performance of incremental test by @mrdziuban + @yhefamly in #9253 + #9364
behind the scenes
- ci: sbt-salad-days by @eed3si9n in #9362
- Update to sbtn 2.0.0-69fa1968 by @eed3si9n in #9398
- deps: Zinc 2.0.1 by @eed3si9n in #9399
Full Changelog: v2.0.0...v2.0.1

See sbt 2.0 change summary.
Full Changelog: v1.12.12...v2.0.0

🐛 bug fixes
- fix: Fixes file permissions by @eed3si9n + @xuwei-k in sbt/io#527 / #9350
- fix: Fixes ArrayIndexOutOfBoundsException error when Unix domain socket is closed by @merlinorg in sbt/ipcsocket#77
Full Changelog: v1.12.12...v1.12.13

bug fixes
- fix: Fixes console that references Java module classes on JDK 9+ by @BrianHotopp in #9327
- fix: Fixes sbt --version to now show JDK warnings on JDK 25 by @bitloi in #8822
- fix: Fixes stdout/stderr not displaying on sbtn by @BrianHotopp in #9265
- fix: Ensure resources are copied atomically by @anatoliykmetyuk in #9196
behind the scenes
- Update sbtn to 2.0.0-f0d2fae4 by @eed3si9n in #9334
- test: Make custom-scala-org scripted test hermetic by @BrianHotopp in #9260
- ci: Skip 2.13 modules from graph submission by @eed3si9n in #9328
Full Changelog: v1.12.11...v1.12.12

bug fix
- fix: Rollback eviction error in Test by @eed3si9n in sbt/librarymanagement#600
Full Changelog: v1.12.10...v1.12.11

updates
- deps: Update log4j to 2.25.4, which fixes CVE-2026-34477, CVE-2026-34478, CVE-2026-34479, CVE-2026-34480 by @dancewithheart in #9086
- deps: Update Gigahorse to 0.9.4, which pulls in httpclient5 5.6.1 by @eed3si9n in #9125
- deps: Update sbtn to 2.0.0-RC13 by @eed3si9n in #9139
- Backport of eviction error in Test configuration by @zainab-ali in #9102
🐛 bug fixes
- fix: Hide JDK warnings if JDK 26 or later by @xuwei-k in #9068
- fix: Fixes managedScalaInstance false support by @eed3si9n in #9121
behind the scenes
- ci: dependency-submission branch set to 1.12.x by @dancewithheart in #9088
new contributors
- @dancewithheart made their first contribution in #9086
Full Changelog: v1.12.9...v1.12.10

Updates
- fix: Prefer local ScalaModuleInfo over global config by @kitbellew in coursier/sbt-coursier#609
Full Changelog: v1.12.8...v1.12.9

updates
- fix: Fixes the source dependency checkout directory by @eed3si9n in #8974
behind the scenes
- fix: Fixes test format by @eed3si9n in #8969
Full Changelog: v1.12.7...v1.12.8

updates
- Revert Coursier back to 2.12.24 (#8902) by @eed3si9n in #8918
Full Changelog: v1.12.6...v1.12.7

updates
- deps: Update lm-coursier to 2.1.12 (Coursier 2.12.25-M19) by @majk-p in #8902
- feat: Retry on HTTP 5xx during dependency resolution by @majk-p in coursier/sbt-coursier#601
- deps: Update log4j to 2.25.3 by @eed3si9n in #8872
- deps: Update semanticdbVersion in SemanticdbPlugin.scala by @xuwei-k in #8885
Full Changelog: v1.12.5...v1.12.6

updates
- bport: sbt runner should fail on JDK < 17 for sbt 2.x by @eureka928 in #8825
- bport: sbtn prints out the error if sever fails to start by @eureka928 in #8816
🐛 bug fixes
- bport: Fixes double quotes handling in JVM argfile by @BrianHotopp in #8765
- bport: Fixes sbt runner comment handling in .sbtopts and .javaopts files by @eed3si9n in #8841
- bport: Fixes sbt runner's sbtn detection by @fireXtract in #8810
Full Changelog: v1.12.4...v1.12.5

- backport: Respect scalaOrganization in compiler bridge resolution by @tanishiking in #8799
- backport: Fixes .jvmopts parse error on Windows Git Bash by reverting "Handle JVM parameters with spaces in dot files" by @eed3si9n in #8798
Full Changelog: v1.12.3...v1.12.4

updates
- fix/bport: Restores Scala 2 reflect/compiler unification by @calm329 in #8707
- fix/bport: Print warning about scala-reflect not found by @eed3si9n in #8733
- fix/bport: Restore runner precedence over .sbtopts by @it-education-md in #8695
- fix/bport: Handle JVM parameters with spaces in dot files by @Eruis2579 in #8730
- fix/bport: Handle --script-version sbt 2.x project dirs by @Eruis2579 in #8715
- fix/bport: Handle --version in sbt 2.x project dirs by @it-education-md in #8735
- fix/bport: Require coreutils for RPM by @eed3si9n in #8712
Full Changelog: v1.12.2...v1.12.3

updates
- Bump to sbtn 1.12.1 by @eed3si9n in #8684
- Use JProcess for interactive forking, which improves terminal detection by @eed3si9n in #8678
- fix: Handle paths with parentheses in sbt.bat on Windows by @Eruis2579 in #8682 / #8656
Full Changelog: v1.12.1...v1.12.2

bug fixes
- fix: Fixes sbt --client new combination by @MkDev11 in #8512
- fix: Fixes sbt new argument parsing on Windows by @MkDev11 in #8509
- fix: Fixes sbtopts files priority in sbt runner script by @mohansinghi in #8520
- fix: Fixes -X support on Windows batch runner by @GlobalStar117 in #8566
- fix: Fixes missing project directory on --addPluginSbtFile command by @azdrojowa123 in #8583
- fix: Invalidates update cache across commands when dependencies change by @calm329 in #8593
- fix: Fixes scala-reflect not found problem when Scala 3.8.1 is used transitively by @eed3si9n in #8633
behind the scenes
- ci: Upgrade launcher-package from sbt 0.13 to 1.x by @MkDev11 in #8493
Full Changelog: v1.12.0...v1.12.1

changes with compatibility implications
- dependencyTree displays internal config, which includes Provided by @eed3si9n in #8359
- Scaladoc now requires Compile / doc / compilers scoped to doc task
🚀 updates
- Adds Scala 3.8 REPL support by @eed3si9n in #8349
- Show warnings when scalaVersion is missing by @eed3si9n in #8432
- deps: Update to Scala 2.12.21 by @xuwei-k in #8407
- BSP: Returns build targets sources from buildTarget/dependencySources request by @azdrojowa123 in #8415
- Adds JDK_JAVA_OPTIONS support in the sbt runner by @sideeffffect in #8413
- Updates semanticdbVersion to 4.14.1 by @xuwei-k in #8342
🐛 bug fixes
- fix: Parses *.sbt files with -Xsource:3 by @eed3si9n in #8368
- fix: Manually construct the string "org.fusesource.jansi" to support sbt 0.13 on Windows by @vasilmkd in sbt/launcher#139
- fix: Fixes Javadoc support on JDK 21 by @adpi2 in sbt/zinc#1622
behind the scenes
- Allows scala3_library to be a JAR-less artifact for Scala 3.8 by @hamzaremmal in #8387
- Update Scala 2.13 used for util cross building to 2.13.18 by @mkurz in #8395
- deps: Zinc 1.12.0 by @eed3si9n in #8434
- ci: Update checkout references to 1.12.x by @eed3si9n in #8355
- ci: Bump coursier/cache-action from 6 to 7 by @dependabot[bot] in #8353
- ci: Bump actions/checkout from 5 to 6 by @dependabot[bot] in #8384
new contributors
- @danicheg made their first contribution in #8346
- @hamzaremmal made their first contribution in #8387
Full Changelog: v1.11.7...v1.12.0

🚀 updates
- Backports JDK 25 JEP-512/JEP-445 Main run by @eed3si9n in #8303
- fix: Fixes runMain task for JEP-512/JEP-445 Main by @xuwei-k in #8316
- Adds ability to filter UpdateReport by configurations by @mdedetrich in sbt/librarymanagement#547
🐛 bug fixes
- fix: Fixes sbt 0.13 launching by @eed3si9n in sbt/launcher#136
🎬 behind the scenes
- ci: Bump actions/setup-python from 5 to 6 by @dependabot[bot] in #8273
- test: Adds some JDK 25 test on CI by @eed3si9n in #8304
- deps: Updates sbt-giter8-resolver version by @xuwei-k in #8309
- test: Fixes fallback-dependencies-inter-project test by @xuwei-k in #8319
- test: Fixes run/daemon-exit test by @xuwei-k in #8320
- test: Update test dependencies by @xuwei-k in #8317
Full Changelog: v1.11.6...v1.11.7

🚀 sbt launcher 1.5.0
- Update launcher code base to to Scala 3.7.2 by @eed3si9n in sbt/launcher#126
- refactor: Adds -Xsource:3 option by @xuwei-k in sbt/launcher#117
- deps: Removes Apache Ivy dependency from launcher by @eed3si9n in sbt/launcher#127
🐛 bug fixes
- fix: Fixes internal dependency classpath #8249 by @azdrojowa123 in #8257
- fix: Fixes client-side run on JDK 8 by @eed3si9n in #8259
🎬 behind the scene
- ci: FIxes building sbtn locally for Aarch64 / arm64 by @eed3si9n in #8258
- ci: Bump actions/checkout from 4 to 5 by @dependabot[bot] in #8246
Full Changelog: v1.11.5...v1.11.6

changes with compatibility implications
- sbtn is built using ubuntu-22.04 image, which will require similar Linux version with glibc 2.32 and above.
🚀 features and other updates
- Adds Scala 3.8.0 support. See below
- Adds Scala Nightly repository resolver. See below
- Adds --jvm-client to the sbt runner script to launch JVM client. See below
- Central Repository publishing: Shows validation errors if present by @unkarjedy in #8191
- Central Repository publishing: Includes the root subproject name into the deployment by @jeanmarc in #8219
- Reduces sbtn outputs by @eed3si9n in #8234
Scala Nightly repository
Scala Team now publishes nightlies to a dedicated Artifactory instance. sbt 1.11.5 adds a new resolver for this:
resolvers += Resolver.scalaNightlyRepository
ThisBuild / scalaVersion := "3.8.0-RC1-bin-20250823-712d5bc-NIGHTLY"
Compile / scalacOptions += "-language:experimental.captureChecking"
This was contributed by @hamzaremmal in sbt/librarymanagement#532
Scala 3.8.0 support
Scala 3.8.0 will in-source the Scala standard library (scala-library) instead of using one from Scala 2.13. sbt 1.11.5 relaxes the Coursier same-version enforcement to support Scala 3.8.0.
This was pair programmed by @hamzaremmal + @eed3si9n during Scala Days 2025 as #8226
sbt --jvm-client
sbt 1.11.5 runner script adds new --jvm-client flag to launch the JVM version of the thin client. The implementation is the Scala code which sbtn is based on. This will be useful on platforms or CPU architectures that we do not build sbtn.
This was contributed by @eed3si9n in #8232
🎬 behind the scene
- ci: Uses sbt 1.11.4 by @eed3si9n in #8192
- ci: Adds clean.yml by @eed3si9n in #8227
- ci: Bump actions/setup-java from 4 to 5 by @dependabot[bot] in #8229
- ci: Split server-test by @eed3si9n in #8233
- deps: Bump to lm 1.11.5 by @eed3si9n in #8231
new contributors
- @jeanmarc made their first contribution in #8219
- @hamzaremmal made their first contribution in #8226
Full Changelog: v1.11.4...v1.11.5

Updates
- fix: Fixes sbt plugin cross building by @eed3si9n in sbt/librarymanagement#528
- fix: Fixes sonaUploadRequestTimeout by scoping globally by @eed3si9n in #8190
Full Changelog: v1.11.3...v1.11.4

updates
- Adds sonaUploadRequestTimeout setting to configure the upload timeout when publishing to the Central Repo by @guizmaii in #8171
- fix: Adds support for pluginCrossBuild/sbtBinaryVersion "1.3", which is used by IntelliJ Scala plugin (fixes #8166) by @unkarjedy in #8167
- fix: Fixes the import order to satisfy SemanticDB by @inglor in #8162
new contributors
- @inglor made their first contribution in #8162
- @guizmaii made their first contribution in #8171
Full Changelog: v1.11.2...v1.11.3

updates
- fix: Fixes intermittent NullPointerError in update task by reverting the use of WeakReferences by @mrdziuban in coursier/sbt-coursier#564
- Adds Resolver.sonatypeCentralSnapshots, Resolver.sonatypeCentralRepo(...) and deprecates Resolver.sonatypeOssRepos(...), Opts.resolver.sonatypeOssReleases , Opts.resolver.sonatypeOssSnapshots, etc by @eed3si9n in sbt/librarymanagement#517 / #8156
Full Changelog: v1.11.1...v1.11.2

updates
- fix: Fixes memory leak in update task by @mrdziuban in coursier/sbt-coursier#563
- fix: Default sbtPluginPublishLegacyMavenStyle to false by @eed3si9n in #8148
- fix: Adds sonaDeploymentName to excludeLintKeys by @rtyley in #8143
behind the scene
- ci: Use Central Portal for publishing by @eed3si9n in #8147
Full Changelog: v1.11.0...v1.11.1

Central Repository publishing
The Central Repository (aka Maven Central) has long been the pillar of the JVM ecosystem including Scala. The mechanism to publish libraries to the Central has been hosted by Sonatype as OSS Repository Hosting (OSSRH) via HTTP PUT, but in March it was announced that the endpoint will be sunset in June 2025 in favor of the Central Portal at https://central.sonatype.com/.
sbt 1.11.0 implements a built-in support to publish to Central Repository via the Central Portal. To publish to the Central Portal, first set ThisBuild / publishTo setting to the localStaging repository:
ThisBuild / publishTo := {
val centralSnapshots = "https://central.sonatype.com/repository/maven-snapshots/"
if (isSnapshot.value) Some("central-snapshots" at centralSnapshots)
else localStaging.value
}
Add credentials to the host central.sonatype.com using the generated user token user name and password. When you're ready to publish, call publishSigned task (available via sbt-pgp). At this point, the JARs and POM files will be staged to your local target/sona-staging directory.
Next, call sonaUpload to upload to the Central Portal and manually release the bundle, or call sonaRelease to upload and automatically release to the Central Repository.
This was contributed by @eed3si9n in #8126. The feature was inspired by sbt-sonatype workflow pioneered by Taro Saito, and sonatype-central-client spearheaded by David Doyle at Lumidion.
Other updates
- fix: Avoid printing "copying runtime jar" etc to stdout by @eed3si9n in #8081
- fix: Fix incremental test (testQuick) with companion objects by @eed3si9n in #8087
Full Changelog: v1.10.11...v1.11.0

updates
- Updates Coursier from 2.1.22 → 2.1.23 by @eed3si9n in #8069
🐛 bug fixes
- fix: Fixes compile task retrying itself on compiler crashes by @eed3si9n in #8070
- fix: sbt --client shutdown shortcuts if the server is not already running by @eed3si9n in #8057
- fix: Fixes sbt --client on Windows by @eed3si9n in #8071
- fix: Avoids creating target on sbt --version by @eed3si9n in #8066
- fix: Fixes slash syntax keys in Scala 2.13 evolution message by @eed3si9n in #8067
Full Changelog: v1.10.10...v1.10.11

🚀 features and other updates
Enable runner script's build detection by default to require --allow-empty by @eed3si9n in #7966
Support glob expressions in scripted to aid sbt 2.0.0-M3 cross building by @eed3si9n in #7933 / #7968
- perf: Precompile a regex in hot code by @retronym in sbt/zinc#1508
Build directory detection
Starting 1.10.7, the sbt runner script enables build directory detection by default. This means that the sbt will exit with error when launched in a directory without build.sbt or project/, with exceptions of sbt new, sbt --script-version etc.

To override this behavior temporarily, you can use --allow-empty flag. To permanently opt out of the build directory detection, create $XDG_CONFIG_HOME/sbt/sbtopts with --allow-empty in it.

csrMavenDependencyOverride setting
sbt 1.10.7 updates Coursier to 2.1.11. sbt 1.10.7 also adds a new setting csrMavenDependencyOverride (default: false), which controls the resolution, which respects Maven dependency override mechanism, also known as bill-of-materials (BOM) POM. Since there is a performance regression in the new resolver, we are setting the default to false.

🐛 bug fixes
- fix: Add csrMavenDependencyOverride to opt into bill-of-material (BOM) respecting Coursier resolution by @eed3si9n in #7970
- fix: Update the template resolver to use Giter8 0.17.0, which fixes the SLF4J warning by @eed3si9n in #7947
- fix: Update JLine 2 fork to 9a88bc4 and Jansi to 2.4.1, which fixes crash on Windows on ARM by @Friendseeker in #7952
🎬 behind the scene
- ci: New Scala CLA URL by @eed3si9n in #7929
- ci: Use new Scala CLA GitHub Action by @Friendseeker in #7953
- ci: Prepare for sbt 1.10.7 by @Friendseeker in #7957
- ci: Restore disabled Multirepo integration test by @Friendseeker in #7962
Full Changelog: v1.10.6...v1.10.7

Changes with compatibility implications
- Uses _sbt2_3 suffix for sbt 2.x by @eed3si9n in #7671
Updates and bug fixes
- Fixes the attribute key name from serverIdleTimeOut to serverIdleTimeout to match the variable name by @lervag in #7651
- Fixes incremental Scala-Java mixed compilation that produces JAR directly by @adpi2 in sbt/zinc#1377
- Fixes over-compilation when using a class directory as a library by @adpi2 in sbt/zinc#1382
- Perf: Copy bytes directly instead of using scala.reflect.io.Streamable by @rochala in sbt/zinc#1395
- Includes all sources and resources in source jar by @jroper in #7630
- Fixes the handling of Optional inter-project dependency in BSP by @adpi2 in #7568
- Trims spaces around k and v to tolerate extra whitespace in build.properties by @invadergir in #7585
- Fixes legacy repositories like scala-tools-releases in repositories file blocking sbt from launching by @eed3si9n in sbt/launcher#104
- Fixes stale BSP diagnostics by @SlowBrainDude in #7610
- Fixes scripted support for sbt 2.x by @eed3si9n in #7672
- Avoids using ThreadDeath for future JDK compatibility by @xuwei-k in #7652
- Avoids using ZipError for future JDK compatibility by @eed3si9n in sbt/zinc#1393
Behind the scenes
- Update to Zinc 1.10.2 by @eed3si9n in #7674
- Update to lm 1.10.1 by @eed3si9n in #7597
- Update to Launcher 1.4.3 by @eed3si9n in #7598
- Update to the common Scala 2.12 version for the sbtn subproject by @SlowBrainDude in #7605
- Note in dev docs on supported build time JDK version dependency by @SlowBrainDude in #7606
- CI: Zinc default branch is 1.10.x by @adpi2 in #7654
- Upgrade sbt plugins to avoid deprecated repo.scala-sbt.org by @mkurz in #7555
- Update Scala 3 doc test by @eed3si9n in #7619
- Bump scalacenter/sbt-dependency-submission from 2 to 3 by @dependabot in #7565
- Fixes dependency-management/force-update-period test (backport of #7538) by @adpi2 in #7567
- Fixes BuildServerTest by @adpi2 in #7638
New contributors
- @invadergir made their first contribution in #7585
- @rochala made their first contribution in sbt/zinc#1395
- @SlowBrainDude made their first contribution in #7606
- @lervag made their first contribution in #7651
Full Changelog: https://github.com/sbt/sbt/compare/v1.10.0...v1.10.2

updates
- Fixes IO.getModifiedOrZero on Alpine etc, by using clib stat() instead of non-standard __xstat64 abi by @bratkartoffel in sbt/io#362
- As a temporary fix for JLine issue, this disables vi-style effects inside emacs by @hvesalai in #7420
- Backports fix for updateSbtClassifiers not downloading sources #7437 by @azdrojowa123
- Backports missing logger methods that take Java Supplier #7447 by @mkurz

Highlights
- sbt 1.9.7 updates its IO module to 1.9.7, which fixes parent path traversal vulnerability in IO.unzip. This was discovered and reported by Kenji Yoshida ([@xuwei-k][@xuwei-k]), and fixed by [@eed3si9n][@eed3si9n] in [io#360][io360].
Other updates and fixes
- Updates Coursier to 2.1.7 by [@regiskuckaertz][@regiskuckaertz] in [#7392][7392]
- Updates Swoval to 2.1.12 by [@eatkins][@eatkins] in [io#353][io353].
- Fixes .sbtopts support for sbt runner script on Windows by [@ptrdom][@ptrdom] in [#7393][7393]
- Adds documentation on scriptedSbt key by [@mdedetrich][@mdedetrich] in [#7383][7383]
- Includes the URL in dependencyBrowseTree log by [@mkurz][@mkurz] in [#7396][7396]

bug fix
- sbt 1.9.6 reverts "internal representation of class symbol names" change (sbt/zinc#1244), which caused Scala compiler to generate wrong anonymous class name by @eed3si9n in sbt/zinc#1256.
See scala/bug#12868 for more details.

highlights
- Switches to pre-compiled compiler bridge for Scala 2.13.12+ [#7374][7374] by [@eed3si9n][@eed3si9n]
- Fixes NPE when just -X is passed to scalacOptions [zinc#1246][zinc1246] by [@unkarjedy][@unkarjedy]
other updates
- Fixes internal representation of class symbol names [zinc#1244][zinc1244] by [@dwijnand][@dwijnand]
- Fixes NumberFormatException in CrossVersionUtil.binaryScalaVersion [lm#426][lm426] by [@HelloKunal][@HelloKunal]
- Fixes scripted client/server instability on Windows [#7087][7087] by [@mdedetrich][@mdedetrich]
- Fixes sbt launcher script bug on Windows [#7365][7365] by [@JD557][@JD557]
- Fixes help command on oldshell [#7358][7358] by [@azdrojowa123][@azdrojowa123]
- Adds allModuleReports to UpdateReport [lm#428][lm428] by [@mdedetrich][@mdedetrich]
- Handles javac warning messages [zinc#1228][zinc1228] by [@Arthurm1][@Arthurm1]
- Enables inliner for Scala 2.13 compiler bridge [zinc#1247][zinc1247] by [@mdedetrich][@mdedetrich]
new contributors
- @azdrojowa123 made their first contribution in #7358
- @JD557 made their first contribution in #7367

Other updates
- Fixes sbt_script lookup by replacing all spaces with %20 (not only the first one) in the path. by @arturaz in #7349
- Fixes scala-debug-adapter#543: Maintain order of internal deps by @adpi2 in #7347
- Removes conscriptConfigs task, not used and needed(?) anymore by @mkurz in #7353
- Adds a Scala 3 seed to the sbt new menu by @SethTisue in #7354
new contributors
- @arturaz made their first contribution in #7349

other updates
- Adds M1/M2/Aarch64 build of sbtn into the installer by @julienrf in #7329
- Fixes scripted tests timing out after 5 minutes by @eed3si9n in #7336

Changes with compatibility implications
- Deprecates IntegrationTest configuration.
See below.
- Updates underlying Coursier to 2.1.2 by [@eed3si9n][@eed3si9n].
Other updates
- Updates Scala 2.13 cross build for Zinc to 2.13.10 to address CVE-2022-36944 by [@rhuddleston][@rhuddleston]
- Updates underlying Scala to 2.12.18 for JDK 21-ea in [#7271][7271] by [@eed3si9n][@eed3si9n].
- Fixes Zinc incremental compilation looping infinitely [zinc#1182][zinc1182] by [@CarstonSchilds][@CarstonSchilds]
- Fixes libraryDependencySchemes not overriding assumedVersionScheme [lm#415][lm415] by [@adriaanm][@adriaanm]
- Fixes spurious whitespace in the runner script by [@keynmol][@keynmol] in [#7134][7134]
- Makes RunProfiler available by [@dragos][@dragos] in [#7215][7215]
- Makes publishLocal / skip work by [@mdedetrich][@mdedetrich] in [#7165][7165]
- Fixes NullPointerError under -Vdebug by [@som-snytt][@som-snytt] in [zinc#1141][zinc1141]
- Fixes Maven settings.xml properties expansion by [@nrinaudo][@nrinaudo] in [lm#413][lm413]
- Adds FileFilter.nothing and FileFilter.everything by [@mdedetrich][@mdedetrich] in [io#340][io340]
- Adds Resolver.
ApacheMavenSnapshotsRepo by [@mdedetrich][@mdedetrich]
- Avoids deprecated java.net.
URL constructor by [@xuwei-k][@xuwei-k] in [io#341][io341]
- Updates to Swoval 2.1.10 by [@eatkins][@eatkins] in [io#343][io343]
- Updates to sbt-giter8-resolver 0.16.2 by [@eed3si9n][@eed3si9n]
- Fixes dead lock between LoggerContext and Terminal by [@adpi2][@adpi2] in [#7191][7191]
- Notifies ClassFileManager from IncOptions in Incremental.prune by [@lrytz] in [zinc1148][zinc1148]
- Updates usage info for java-home in the runner script by [@liang3zy22][@liang3zy22] in [#7171][7171]
- Deprecates misspelled Problem#diagnosticRelatedInforamation by [@ckipp01][@ckipp01] in [#7241][7241]
- Adds built-in support for weaver-cats test framework [#7263][7263] by [@kubukoz][@kubukoz]
Behind the scene
- Replaces olafurpg/setup-scala with actions/setup-java by [@mzuehlke][@mzuehlke] in [#7154][7154]
- Uses sonatypeOssRepos instead of sonatypeRepo by [@yoshinorin][@yoshinorin] in [#7227][7227]

Security fix
- Fixes sbt.io.
IO.withTemporaryFile not limiting access on Unix-like systems in [io#344][io344]/[zinc#1185][zinc1185] by [@eed3si9n][@eed3si9n]
- Fixes Zinc incremental compilation looping infinitely [zinc#1182][zinc1182] by [@CarstonSchilds][@CarstonSchilds]
- Fixes spurious whitespace in the runner script by [@keynmol][@keynmol] in [#7134][7134]
- Fixes NullPointerError under -Vdebug by [@som-snytt][@som-snytt] in [zinc#1141][zinc1141]
- Avoids deprecated java.net.
URL constructor by [@xuwei-k][@xuwei-k] in [io#341][io341]
- Updates to Swoval 2.1.10 by [@eatkins][@eatkins] in [io#343][io343]
- Notifies ClassFileManager from IncOptions in Incremental.prune by [@lrytz] in [zinc1148][zinc1148]
- Adds FileFilter.nothing and FileFilter.everything by [@mdedetrich][@mdedetrich] in [io#340][io340]