Protobuf with potential Denial of Service (CVE-2024-7254)

sbt 1.10.3 updates protobuf-java library to 3.25.5 to address CVE-2024-7254 / GHSA-735f-pc8j-v9w8, which states that while parsing unknown fields in the Protobuf Java library, a maliciously crafted message can cause a StackOverflow error. Given the nature of how Protobuf is used in Zinc as internal serialization, we think the impact of this issue is minimum. However, security software might still flag this to be an issue while using sbt or Zinc, so upgrade is advised. This issue was originally reported by @gabrieljones and was fixed by Jerry Tan (@Friendseeker) in zinc#1443.

@adpi2 at Scala Center has also configured dependency graph submission to get security alerts in zinc#1448. sbt/sbt was configured by @Friendseeker in #7746.

Reverting the invalidation of circular-dependent sources

sbt 1.10.3 reverts the initial invalidation of circular-dependent Scala source pairs.

There had been a series of incremental compiler bugs such as "Invalid superClass" and "value b is not a member of A" that would go away after clean. The root cause of these bugs were identified by @smarter (sbt/zinc#598 (comment)) and @Friendseeker to be partial compilation of circular-dependent sources where two sources A.scala and B.scala use some constructs from each other.

sbt 1.10.0 fixed this issue via sbt/zinc#1284 by invalidating the circular-dependent pairs together. In other words, if A.scala was changed, it would immediately invalidate B.scala. It turns out, that people have been writing circular-dependent code, and this has resulted in multiple reports of Zinc's over-compilation (zinc#1420, zinc#1461). Given that the invalidation seems to affect the users more frequently than the original bug, we're going to revert the fix for now. We might bring this back with an opt-out flag later on. The revert was contributed by by Li Haoyi (@lihaoyi) in sbt/zinc#1462.

Improvement: ParallelGzipOutputStream

sbt 1.10.0 via sbt/zinc#1326 added a new consistent (repeatable) formats for Analysis storage. As a minor optimization, the pull request also included an implementation of ParallelGzipOutputStream, which would reduce the generate file size by 20%, but with little time penalty. Unfortunately, however, we have observed in CI that that the scala.concurrent.Future-based implementation gets stuck in a deadlock. @Ichoran and @Friendseeker have contributed an alternative implementation that uses Java threads directly, which fixes the issue in sbt/zinc#1466.

bug fixes and updates

• deps: Updates metabuild Scala version to 2.12.20 by @SethTisue in #7636
• fix: Fixes "illegal reflective access operation" error on JDK 11 by updating JLine to 3.27.0 by @Friendseeker in #7695
• fix: Fixes transitive invalidation interfering with cycle stopping condition by @Friendseeker in zinc#1397
• fix: Fixes dependency resolution of sbt plugins by excluding custom extra attributes from POM dependencies by @adpi2 in lm#451
• fix: Fixes directory permission issue under a multi-user environment by @eed3si9n in ipcsocket#43
• deps: Updates sbt init template deps by @xuwei-k in #7730
• Updates sbt runner to default to sbtn for sbt 2.x by @eed3si9n in #7775

behind the scene

• ci: Bump CI to JDK 21 by @Friendseeker in #7760
• refactor: Remove deprecated System.runFinalization by @Friendseeker in #7732
• refactor: Remove deprecated Thread.getId by @Friendseeker in #7733
• refactor: Regenerate Contraband files by @Friendseeker in #7764
• deps: Bump IO, ipc-socket, and launcher by @eed3si9n in #7776
• deps: Zinc 1.10.3 by @eed3si9n in #7781
• deps: lm 1.10.2 by @eed3si9n in #7782
• ci: Set a default timeout for ci by @nathanlao in #7766
• ci: Removes vscode-sbt-scala from build.sbt by @Friendseeker in #7728
• ci: Adds dependabot setting for develop branch by @xuwei-k in #7701

Full Changelog: v1.10.2...v1.10.3