Dies ist eine ältere Version. Aktuell ist Version 2.0.12. sbt 2.0.12 · Veröffentlicht:
Installationsdateien 2.0.7
| Architektur | Typ | Bereich | Dateigröße | Download | SHA256 |
|---|---|---|---|---|---|
| 32-Bit | MSI · en-US | Alle Benutzer | — | github.com | VirusTotal |
Link und SHA256 stammen aus dem Community-Manifest des Windows-Paket-Managers. Vergleichen Sie den Hash der heruntergeladenen Datei, bevor Sie sie ausführen.
Versionshinweise
⚠️ Remote code execution vulnerability fix
sbt team received a security report GHSA-943m-f264-54p4 from @stasimus that when the serverConnectionType is set to Tcp, an attacker is able to execute arbitrary code remotely via BSP, similar to a recent bug that was found in JSON-RPC. sbt 1.13.0 and 2.0.7 fix this bug.
Builds with the default serverConnectionType are not affected. In affected builds, we recommend removing the serverConnectionType setting, or upgrading to a patched version or later. In an affected build, the setting might look like this:
Global / serverConnectionType := ConnectionType.Tcp
The remediation was implemented by @stasimus.
🚀 updates
- perf: Stop re-converting the classpath in compileOptions by @hoangmaihuy in #9622
🐛 bug fixes
- fix: Guard diskcache against path traversal by @eed3si9n in #9605
- fix: Name the platform in CrossVersion(module, scalaModuleInfo) by @kitbellew in #9620
- fix: Avoid rewriting unchanged plugin descriptors by @unkarjedy in #9624
- fix: Fixes scalacOptions in BSP using VirtualFileRef by @azdrojowa123 in #9610
- fix: Fixes -V parsing in sbt runners by @anatoliykmetyuk in #9626
- fix: Fixes filesystem traversal order affecting cache stability by @christianharrington in #9646
behind the scenes
- ci: Remove cla-checker v1 by @eed3si9n in #9571
- Update sbtn to 2.0.0-8753a981 by @eed3si9n in #9630
Full Changelog: v2.0.6...v2.0.7
