u/eed3si9n

kicking off sbt 2.1.0 beta with 2.1.0-M1. sbt 2.1.0 features:

• Scala 3.9.0 on the metabuild
• Ivyless publishing
• Updated clean task
• Testing UX improvements
• Various performance improvements and many contributed bug fixes

sbt 1.13.0 and 2.0.7 are released with a fix for remote code execution vulnerability via BSP over TCP. Builds with the default serverConnectionType are not affected.

📢 Released sbt 1.12.15 and 2.0.6, featuring vulnerability fix for remote code execution via server when serverConnectionType is set to Tcp. We recommend removing the serverConnectionType setting, or upgrading to a patched version or later.

🧑‍🚒 released sbt 1.12.14 and 2.0.3, featuring

• backport of CVE-2026-26032 fix for Ivy (while sbt might not be affected)
• update to Jawn 1.7.0 for CVE-2026-59990 and CVE-2026-61814 fixes

sbt 2.0 is a new major series of sbt, based on Scala 3 constructs and Bazel-compatible cache system. many thanks to Scala Center, Anatolii Kmetiuk (new maintainer), Adrien Piquerez (alumni), and other volunteers like Kenji Yoshida https://eed3si9n.com/sbt-2.0.0