Update dependency sbt/sbt to v1.9.6 #229
No reviewers
Labels
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
navicore/NaviPath!229
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "renovate/sbt-sbt-1.x"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
1.8.2->1.9.6Release Notes
sbt/sbt (sbt/sbt)
v1.9.6: 1.9.6Compare Source
bug fix
Full Changelog: https://github.com/sbt/sbt/compare/v1.9.5...v1.9.6
v1.9.5: 1.9.5Compare Source
Update: ⚠️ sbt 1.9.5 is broken, because it causes Scala compiler to generate wrong class names for anonymous class on lambda. While we investigate please refrain from publishing libraries with it.
https://github.com/scala/bug/issues/12868#issuecomment-1720848704
highlights
-Xis passed toscalacOptionszinc#1246 by @unkarjedyother updates
NumberFormatExceptioninCrossVersionUtil.binaryScalaVersionlm#426 by @HelloKunalscriptedclient/server instability on Windows #7087 by @mdedetrichsbtlauncher script bug on Windows #7365 by @JD557helpcommand on oldshell #7358 by @azdrojowa123allModuleReportstoUpdateReportlm#428 by @mdedetrichnew contributors
Full Changelog: https://github.com/sbt/sbt/compare/v1.9.4...v1.9.5
v1.9.4: 1.9.4Compare Source
CVE-2022-46751
CVE-2022-46751 is a security vulnerability discovered in Apache Ivy, but found also in Coursier.
With coordination with Apache Foundation, Adrien Piquerez (@adpi2) from Scala Center backported the fix to both our Ivy 2.3 fork and Coursier. sbt 1.9.4 updates them to the fixed versions.
Other updates
sbt_scriptlookup by replacing all spaces with%20(not only the first one) in the path. by @arturaz in https://github.com/sbt/sbt/pull/7349conscriptConfigstask, not used and needed(?) anymore by @mkurz in https://github.com/sbt/sbt/pull/7353sbt newmenu by @SethTisue in https://github.com/sbt/sbt/pull/7354new contributors
Full Changelog: https://github.com/sbt/sbt/compare/v1.9.3...v1.9.4
v1.9.3: 1.9.3Compare Source
Actionable diagnostics (aka quickfix)
Actionable diagnostics, or quickfix, is an area in Scala tooling that's been getting attention since Chris Kipp presented it in the March 2023 Tooling Summit. Chris has written the roadmap and sent sbt/sbt#7242 that kickstarted the effort, but now there's been steady progress in Build Server Protocol, Dotty, Scala 2.13, IntelliJ, Zinc, etc. Metals 1.0.0, for example, is now capable of surfacing code actions as a quickfix.
sbt 1.9.3 adds a new interface called
AnalysisCallback2to relay code actions from the compiler(s) to Zinc's Analysis file. Future version of Scala 2.13.x (and hopefully Scala 3) will release with proper code actions, but as a demo I've implemented a code action for procedure syntax usages even on current Scala 2.13.11 with-deprecationflag.This was contributed by Eugene Yokota (@eed3si9n) in zinc#1226. Special thanks to @lrytz for identifying this issue in zinc#1214.
other updates
Full Changelog: https://github.com/sbt/sbt/compare/v1.9.2...v1.9.3
v1.9.2: 1.9.2Compare Source
Fix
++fall back to a bincompat Scala version by @eed3si9n in https://github.com/sbt/sbt/pull/7328Full Changelog: https://github.com/sbt/sbt/compare/v1.9.1...v1.9.2
v1.9.1: 1.9.1Compare Source
Change to Scala CLA
sbt 1.9.1 is the first release of sbt after changing to Scala CLA in #7306 etc. A number of contributors to sbt voiced concerns about donating our work to Lightbend after 2022, and Lightbend, Scala Center, and I agreed on changing the contributor license agreement such that the copyright would tranfer to Scala Center, a non-profit organization. sbt and its subcompoments, including Zinc, will remain available under Apache v2 license.
Updates
publish / skipis settrueby @adpi2 in #7295sbtPluginPublishLegacyMavenStyle := falseby @adpi2 in #7286sbt consolebeing slow by @andrzejressel in #7280exportPipeliningkey by @alexklibisz in #7291dependencyBrowseGraphanddependencyDotrender in color by @sideeffffect in #7301. This can be opted-out usingdependencyDotNodeColorssetting.sbt newdefault menu by @katlasik in #7300sbt newdefault menu extensible viatemplateDescriptionssetting key andtemplateRunLocalinput key by @eed3si9n in #7304semanticdbVersionto 4.7.8 by @ckipp01 in #7294Behind the scene
@tailrecannotation by @xuwei-k in zinc#1209DEVELOPING.mdby @dongxuwang in #7299java.net.URLconstructor by @xuwei-k in #7315filtertowithFilterwhere possible by @xuwei-k in #7317new contributors
Full Changelog: https://github.com/sbt/sbt/compare/v1.9.0...v1.9.1
v1.9.0: 1.9.0Compare Source
Changes with compatibility implications
IntegrationTestconfiguration. See below.Deprecation of IntegrationTest configuration
sbt 1.9.0 deprecates
IntegrationTestconfiguration. (RFC-3 proposes to deprecate general use of configuration axis beyondCompileandTest, and this is the first installment of the change.)The recommended migration path is to create a subproject named "integration", or "foo-integration" etc.
From the shell you can run:
Assuming these are slow tests compared to the regular tests, I might not aggregate them at all from other subprojects, and maybe only run it on CI, but it's up to you.
Why deprecate
IntegrationTest?IntegrationTestwas a demoware for the idea of custom configuration axis, and now that we are planning to deprecate the mechanism to simplify sbt, we wanted to stop advertising it. We won't remove it during sbt 1.x series, but deprecation signals the non-recommendation status.This was contributed by @eed3si9n and @mdedetrich in lm#414/#7261.
POM consistency of sbt plugin publishing
sbt 1.9.0 publishes sbt plugin to Maven repository in a POM-consistent way. sbt has been publishing POM file of sbt plugins as
sbt-something-1.2.3.pomeven though the artifact URL is suffixed assbt-something_2.12_1.0. This allowed "sbt-something" to be registered by Maven Central, allowing search. However, as more plugins moved to Maven Central, it was considered that keeping POM consisntency rule was more important, especially for corporate repositories to proxy them.sbt 1.9.0 will publish using both the conventional POM-inconsistent style and POM-consistent style so prior sbt releases can still consume the plugin. However, this can be opted-out using
sbtPluginPublishLegacyMavenStylesetting.This fix was contributed by Adrien Piquerez (@adpi2) at Scala Center in coursier#2633, sbt#7096 etc. Special thanks to William Narmontas (@ScalaWilliam) and Wudong Liu (@wudong) whose experimental plugin sbt-vspp paved the way for this feature.
sbt new, a text-based adventuresbt 1.9.0 adds text-based menu when
sbt neworsbt initis called without arguments:Unlike Giter8,
.localtemplate createsbuild.sbtetc in the current directory, and reboots into an sbt session.This was contributed by Eugene Yokota (@eed3si9n) in #7228.
Actionable diagnostics steps
sbt 1.9.0 adds
actionstoProblem, allowing the compiler to suggest code edits as part of the compiler warnings and errors in a structual manner.See Roadmap for actionable diagnostics for more details. The changes were contributed by @ckipp01 in #7242 and @eed3si9n in bsp#527/#7251/zinc#1186 etc.
releaseNotesURLsettingsbt 1.9.0 adds
releaseNotesURLsetting, which createsinfo.releaseNotesUrlproperty in the POM file. This will then be used by Scala Steward. SeeAdd release notes URLs to your POMs for details.
This was contributed by Arman Bilge in lm#410.
Other updates
libraryDependencySchemesnot overridingassumedVersionSchemelm#415 by @adriaanmRunProfileravailable by @dragos in #7215publishLocal / skipwork by @mdedetrich in #7165-Vdebugby @som-snytt in zinc#1141settings.xmlproperties expansion by @nrinaudo in lm#413FileFilter.nothingandFileFilter.everythingby @mdedetrich in io#340Resolver.ApacheMavenSnapshotsRepoby @mdedetrichjava.net.URLconstructor by @xuwei-k in io#341LoggerContextandTerminalby @adpi2 in #7191ClassFileManagerfromIncOptionsinIncremental.pruneby @lrytz in zinc1148Problem#diagnosticRelatedInforamationby @ckipp01 in #7241Behind the scene
Replaces olafurpg/setup-scala with actions/setup-java by @mzuehlke in #7154
Uses
sonatypeOssReposinstead ofsonatypeRepoby @yoshinorin in #7227v1.8.3: 1.8.3Compare Source
Security fix
sbt.io.IO.withTemporaryFilenot limiting access on Unix-like systems in io#344/zinc#1185 by @eed3si9nIO.withTemporaryFile fix
sbt 1.8.3 fixes
sbt.io.IO.withTemporaryFileetc not limiting access on Unix-like systems. Prior to this patch release, some functions were usingjava.io.File.createTempFile, which does not set strict file permissions, as opposed to the NIO-equivalent that does.This means that on a shared Unix-like systems, build user or plugin's use of
sbt.io.IO.withTemporaryFileetc would have exposed the information to other users.This issue was reported by Oleksandr Zolotko at IBM, and was fixed by Eugene Yokota (@eed3si9n) in io#344/zinc#1185.
Other updates
sbt 1.8.3 backports Zinc and IO fixes from 1.9.0-RC2 as well.
Fixes Zinc incremental compilation looping infinitely zinc#1182 by @CarstonSchilds
Fixes spurious whitespace in the runner script by @keynmol in #7134
Fixes NullPointerError under
-Vdebugby @som-snytt in zinc#1141Avoids deprecated
java.net.URLconstructor by @xuwei-k in io#341Updates to Swoval 2.1.10 by @eatkins in io#343
Notifies
ClassFileManagerfromIncOptionsinIncremental.pruneby @lrytz in zinc1148Adds
FileFilter.nothingandFileFilter.everythingby @mdedetrich in io#340Configuration
📅 Schedule: Branch creation - "before 3am on the first day of the month" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.