Skip to content

chore(deps): update dependency sbt/sbt to v1 #2915

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Nov 9, 2023
Merged

chore(deps): update dependency sbt/sbt to v1 #2915

merged 1 commit into from
Nov 9, 2023

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented May 29, 2023

Mend Renovate

This PR contains the following updates:

Package Update Change
sbt/sbt major 0.13.18 -> 1.8.3

Release Notes

sbt/sbt

v1.8.3: 1.8.3

Compare Source

Security fix
IO.withTemporaryFile fix

sbt 1.8.3 fixes sbt.io.IO.withTemporaryFile etc not limiting access on Unix-like systems. Prior to this patch release, some functions were using java.io.File.createTempFile, which does not set strict file permissions, as opposed to the NIO-equivalent that does.

This means that on a shared Unix-like systems, build user or plugin's use of sbt.io.IO.withTemporaryFile etc would have exposed the information to other users.

This issue was reported by Oleksandr Zolotko at IBM, and was fixed by Eugene Yokota (@​eed3si9n) in io#​344/zinc#​1185.

Other updates

sbt 1.8.3 backports Zinc and IO fixes from 1.9.0-RC2 as well.

v1.8.2: 1.8.2

Compare Source

updates

v1.8.1: 1.8.1

Compare Source

Bug fixes

Updates

New Contributors

Full Changelog: sbt/sbt@v1.8.0...v1.8.1

v1.8.0: 1.8.0

Compare Source

Security fixes

  • Updates to Coursier 2.1.0-RC1 to address CVE-2022-37866
  • Updates to Ivy 2.3.0-sbt-a8f9eb5bf09d0539ea3658a2c2d4e09755b5133e to address CVE-2022-37866

Changes with compatibility implications

  • Updates to Scala 2.12.17 + Scala compiler 2.12.17, which upgrades to scala-xml 2.x #​7021

Bug fixes

Other updates

  • Adds long classpath support on JDK 9+ via argument file (opt out using -Dsbt.argsfile=false or SBT_ARGSFILE environment variable) #​7010 by @​easel
  • Adds out-of-box ZIO Test support #​7053 by @​987Nabil
  • Adds support for newly introduced buildTarget/outputPaths method of Build Server Protocol. #​6985 by @​povder

New Contributors

Full Changelog: sbt/sbt@v1.7.1...v1.8.0

v1.7.3: 1.7.3

Compare Source

updates

new contributors

Full Changelog: sbt/sbt@v1.7.2...v1.7.3

v1.7.2: 1.7.2

Compare Source

See https://github.com/sbt/sbt/releases/tag/v1.7.0 for the details on sbt 1.7.x.

v1.7.1: 1.7.1

Compare Source

See https://github.com/sbt/sbt/releases/tag/v1.7.0 for the details on sbt 1.7.x.

Bug fix

Full Changelog: sbt/sbt@v1.7.0...v1.7.1

v1.7.0: 1.7.0

Compare Source

Changes with compatibility implications
++ command updates

Prior to sbt 1.7 ++ <sv> <command1> filtered subprojects using crossScalaVersions having the same ABI suffix as <sv>. This behavior was generally not well understood, and also created incorrect result for Scala 3.x since ++ 3.0.1 test could downgrade subproject that may require 3.1 or above.

sbt 1.7.0 fixes this by requiring ++ <sv> <command1> so <sv> part can be given as a semantic version selector expression, such as 3.1.x or 2.13.x. Note that the expression may match at most one Scala version to switch into. In sbt 1.7.0, a concrete version such as ++ 3.0.1 equires exact version to be present in crossScalaVersion.

This contribution was a collaborated effort among Arnout Engelen #​6894, Rui Gonçalves lm#​400, and Eugene Yokota.

Scala 3 compiler error improvements

In zinc#​1082, Toshiyuki Takahashi contributed a fix to ignore Problem#rendered passed from the compiler when sbt uses position mapper to transform the position. This is aimed at fixing the error reporting for Play on Scala 3.

In #​6874, Chris Kipp extended xsbti.Problem to track richer information available in Scala 3. This is aimed at enhancing the compilation errors reported to BSP client such as Metals.

BSP updates
Other updates

v1.6.2: 1.6.2

Compare Source

License

sbt 1.6.2 adds License object that defines predefined license values:

licenses := List(License.Apache2)

Predefined values are License.Apache2, License.MIT, License.CC0, and License.GPL3_or_later. lm#​395 by @​eed3si9n

v1.6.1: 1.6.1

Compare Source

v1.6.0: 1.6.0

Compare Source

Changes with compatibility implications
BSP improvements
Zinc improvements
Remote caching improvements

sbt 1.6.0 improves remote caching of resources directory by virtualizing the internal sync state (copy-resources.txt). This allows incremental resource directory synching to be resumed from the remote cache, similar to how Zinc has been able to resume incremental compilation from the remote cache. This was contributed by Amina Adewusi (@​Nirvikalpa108) as #​6611.

Dependency tree improvements
Other updates

v1.5.8: 1.5.8

Compare Source

  • sbt 1.5.8 updates log4j 2 to 2.17.0, which fixes a denial of service vulnerability caused by infinite recursion (CVE-2021-45105) #​6755 by @​augi

v1.5.7: 1.5.7

Compare Source

v1.5.6: 1.5.6

Compare Source

v1.5.5: 1.5.5

Compare Source

v1.5.4: 1.5.4

Compare Source

v1.5.3: 1.5.3

Compare Source

v1.5.2: 1.5.2

Compare Source

v1.5.1: 1.5.1

Compare Source

v1.5.0: 1.5.0

Compare Source

The headline features of sbt 1.5.0 are:

  • Scala 3 support
  • Eviction error
  • Deprecation of sbt 0.13 syntax
  • Coursier-based launcher
Scala 3 support

sbt 1.5.0 adds built-in Scala 3 support, contributed by Scala Center. Main implementation was done by Adrien Piquerez (@​adpi2) based on EPFL/LAMP's sbt-dotty. You can now use Scala 3.0.0-RC2 like any other Scala version.

ThisBuild / scalaVersion := "3.0.0-RC2"

This will compile the following Hello.scala:

package example

@&#8203;main def hello(arg: String*): Unit =
  if arg.isEmpty then println("hello")
  else println(s"hi ${arg.head}")

Note: To support cross testing of various Scala 3.x releases, crossTarget directory will contain the full Scala version. #​6415

Scala 2.13-3.x sandwich

Scala 3.0.x shares the standard library with Scala 2.13, and since Scala 2.13.4, they can mutually consume the output of each other as external library. This allows you to create Scala 2.13-3.x sandwich, a layering of dependencies coming from different Scala versions.

Warning: Library authors should generally treat Scala 3.0 as any other major version, and prefer to cross publish _3 variant to avoid the conflict. Some libraries may encode a particular notion in different ways for Scala 2.13 and 3.0. For example, arity abstraction may use Shapeless HList in Scala 2.13, but built-in Tuple types in Scala 3.0. Thus it's generally not safe to have _2.13 and _3 versions of the same library in the classpath, even transitively. Application developers should be free to use .cross(CrossVersion.for3Use2_13) as long as the transitive dependency graph will not introduce _2.13 variant of a library you already have in _3 variant.

sbt 1.5.0 introduces new cross building operand to use _3 variant when scalaVersion is 2.13.x, and vice versa:

("a" % "b" % "1.0").cross(CrossVersion.for3Use2_13)

("a" % "b" % "1.0").cross(CrossVersion.for2_13Use3)

lm#​361 by @​adpi2

Deprecation of sbt 0.13 syntax

sbt 1.5.0 deprecates both the sbt 0.13 style shell syntax proj/config:intask::key and sbt 0.13 style build.sbt DSL key in (Compile, intask) in favor of the unified slash syntax.

There's a syntactic Scalafix rule for unified slash syntax
to semi-automatically rewrite existing sbt 0.13 syntax to the slash syntax. Currently it requires the use of scalafix CLI
and it's not very precise (because it's a syntactic rule that only looks at the shape of the code) but it gets most of the job done.

$ scalafix --rules=https://gist.githubusercontent.com/eed3si9n/57e83f5330592d968ce49f0d5030d4d5/raw/7f576f16a90e432baa49911c9a66204c354947bb/Sbt0_13BuildSyntax.scala *.sbt project/*.scala

See https://www.scala-sbt.org/1.x/docs/Migrating-from-sbt-013x.html#slash for details.

Eviction error

sbt 1.5.0 removes eviction warning, and replaces it with stricter eviction error. Unlike the eviction warning that was based on speculation, eviction error only uses the ThisBuild / versionScheme information supplied by the library authors.

For example:

lazy val use = project
  .settings(
    name := "use",
    libraryDependencies ++= Seq(
      "org.http4s" %% "http4s-blaze-server" % "0.21.11",
      // https://repo1.maven.org/maven2/org/typelevel/cats-effect_2.13/3.0.0-M4/cats-effect_2.13-3.0.0-M4.pom
      // is published with early-semver
      "org.typelevel" %% "cats-effect" % "3.0.0-M4",
    ),
  )

The above build will fail to build use/compile with the following error:

[error] stack trace is suppressed; run last use / update for the full output
[error] (use / update) found version conflict(s) in library dependencies; some are suspected to be binary incompatible:
[error]
[error]   * org.typelevel:cats-effect_2.12:3.0.0-M4 (early-semver) is selected over {2.2.0, 2.0.0, 2.0.0, 2.2.0}
[error]       +- use:use_2.12:0.1.0-SNAPSHOT                        (depends on 3.0.0-M4)
[error]       +- org.http4s:http4s-core_2.12:0.21.11                (depends on 2.2.0)
[error]       +- io.chrisdavenport:vault_2.12:2.0.0                 (depends on 2.0.0)
[error]       +- io.chrisdavenport:unique_2.12:2.0.0                (depends on 2.0.0)
[error]       +- co.fs2:fs2-core_2.12:2.4.5                         (depends on 2.2.0)
[error]
[error]
[error] this can be overridden using libraryDependencySchemes or evictionErrorLevel

This is because Cats Effect 2.x and 3.x are found in the classpath, and Cats Effect has declared that it uses early-semver. If the user wants to opt-out of this, the user can do so per module:

ThisBuild / libraryDependencySchemes += "org.typelevel" %% "cats-effect" % VersionScheme.Always

or globally as:

ThisBuild / evictionErrorLevel := Level.Info

On the other hand, if you want to bring back the guessing feature in eviction warning, you can do using the following settings:

ThisBuild / assumedVersionScheme := VersionScheme.PVP
ThisBuild / assumedVersionSchemeJava := VersionScheme.EarlySemVer
ThisBuild / assumedEvictionErrorLevel := Level.Warn

@​eed3si9n implemented this in #​6221, inspired in part by Scala Center's sbt-eviction-rules, which was implemented by Alexandre Archambault (@​alxarchambault) and Julien Richard-Foy (@​julienrf).

ThisBuild / packageTimestamp setting

In sbt 1.4.0 we started wiping out the timestamps in JAR to make the builds more repeatable. This had an unintended consequence of breaking Play's last-modified response header.

To opt out of this default, the user can use:

ThisBuild / packageTimestamp := Package.keepTimestamps

// or

ThisBuild / packageTimestamp := Package.gitCommitDateTimestamp

#​6237 by @​eed3si9n

Coursier-based launcher

sbt launcher shipped in the official installer of sbt is a generic launcher that is able to launch all versions of sbt. For the sbt launcher shipped with sbt 1.5.0 installer, its internal dependency resolver used to resolve sbt itself was updated from Apache Ivy to Coursier (Dependency resolver for the built has been updated to Coursier in sbt 1.3.0).

You can use -Dsbt.launcher.coursier=false to opt out of using Coursier and used Apache Ivy instead. launcher#​86 by @​eed3si9n

Other updates

v1.4.9: 1.4.9

Compare Source

Changes since 1.4.9

sbt 1.4.9 fixes JLine 2 fork + JAnsi version to match that of JLine 3.19.0 to fix line reading, which among other things affected IntelliJ import.

Changes with compatibility implications

sbt 1.4.9 is published to Sonatype OSS without going through Bintray.

  • Prior to 1.4.9, sbt-launcher was published twice under sbt-launch.jar and Maven-compatible sbt-launch-<version>.jar. We're no longer going to publish the Maven incompatible form of the launcher JAR. The latest sbt-extras has already migrated to the correct URL, but CI environments using and older version of it may experience disruptions. As the fix, curl *.tgz from GitHub release.
  • DEB and RPM packages are not provided for this release. I hope we will have a replacement repo up to eventually be able to support this, but we do not have one yet. For now, download *.tgz from GitHub release.
Migration note for Travis CI

If you're using Travis CI, you might run into the above issue because it's using an older version of sbt-extras. Here's how you can use the official sbt launcher script instead:

install:
  - |

### update this only when sbt-the-bash-script needs to be updated
    export SBT_LAUNCHER=1.4.9
    export SBT_OPTS="-Dfile.encoding=UTF-8"
    curl -L --silent "https://github.com/sbt/sbt/releases/download/v$SBT_LAUNCHER/sbt-$SBT_LAUNCHER.tgz" > $HOME/sbt.tgz
    tar zxf $HOME/sbt.tgz -C $HOME
    sudo rm /usr/local/bin/sbt
    sudo ln -s $HOME/sbt/bin/sbt /usr/local/bin/sbt
script:
  - sbt -v "+test"
Fixes

v1.4.8: 1.4.8

Compare Source

Changes with compatibility implications

sbt 1.4.8 is published to Sonatype OSS without going through Bintray.

  • Prior to 1.4.8, sbt-launcher was published twice under sbt-launch.jar and Maven-compatible sbt-launch-<version>.jar. We're no longer going to publish the Maven incompatible form of the launcher JAR. The latest sbt-extras has already migrated to the correct URL, but CI environments using and older version of it may experience disruptions. As the fix, curl *.tgz from GitHub release.
  • DEB and RPM packages are not provided for this release. I hope we will have a replacement repo up to eventually be able to support this, but we do not have one yet. For now, download *.tgz from GitHub release.
Migration note for Travis CI

If you're using Travis CI, you might run into the above issue because it's using an older version of sbt-extras. Here's how you can use the official sbt launcher script instead:

install:
  - |

### update this only when sbt-the-bash-script needs to be updated
    export SBT_LAUNCHER=1.4.8
    export SBT_OPTS="-Dfile.encoding=UTF-8"
    curl -L --silent "https://github.com/sbt/sbt/releases/download/v$SBT_LAUNCHER/sbt-$SBT_LAUNCHER.tgz" > $HOME/sbt.tgz
    tar zxf $HOME/sbt.tgz -C $HOME
    sudo rm /usr/local/bin/sbt
    sudo ln -s $HOME/sbt/bin/sbt /usr/local/bin/sbt
script:
  - sbt -v "+test"
Fixes

Configuration

📅 Schedule: Branch creation - "every 3 weeks on Monday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

@renovate renovate bot added the dependencies Pull requests that update a dependency file label May 29, 2023
@vlsi vlsi merged commit 168dde0 into master Nov 9, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
dependencies Pull requests that update a dependency file
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@vlsi