Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update dependency sbt/sbt to v1.9.3 #626

Merged
merged 1 commit into from
Aug 24, 2023
Merged

Update dependency sbt/sbt to v1.9.3 #626

merged 1 commit into from
Aug 24, 2023

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Aug 1, 2023

Mend Renovate

This PR contains the following updates:

Package Update New value References Sourcegraph
sbt/sbt minor 1.9.3 source code search for "sbt/sbt"

Test plan: CI should pass with updated dependencies. No review required: this is an automated dependency update PR.

Release Notes

sbt/sbt (sbt/sbt)

v1.9.3: 1.9.3

Compare Source

Actionable diagnostics (aka quickfix)

Actionable diagnostics, or quickfix, is an area in Scala tooling that's been getting attention since Chris Kipp presented it in the March 2023 Tooling Summit. Chris has written the roadmap and sent sbt/sbt#7242 that kickstarted the effort, but now there's been steady progress in Build Server Protocol, Dotty, Scala 2.13, IntelliJ, Zinc, etc. Metals 1.0.0, for example, is now capable of surfacing code actions as a quickfix.

sbt 1.9.3 adds a new interface called AnalysisCallback2 to relay code actions from the compiler(s) to Zinc's Analysis file. Future version of Scala 2.13.x (and hopefully Scala 3) will release with proper code actions, but as a demo I've implemented a code action for procedure syntax usages even on current Scala 2.13.11 with -deprecation flag.

This was contributed by Eugene Yokota (@​eed3si9n) in zinc#1226. Special thanks to @​lrytz for identifying this issue in zinc#1214.

other updates

Full Changelog: sbt/sbt@v1.9.2...v1.9.3

v1.9.2: 1.9.2

Compare Source

Fix

Full Changelog: sbt/sbt@v1.9.1...v1.9.2

v1.9.1: 1.9.1

Compare Source

Change to Scala CLA

sbt 1.9.1 is the first release of sbt after changing to Scala CLA in #​7306 etc. A number of contributors to sbt voiced concerns about donating our work to Lightbend after 2022, and Lightbend, Scala Center, and I agreed on changing the contributor license agreement such that the copyright would tranfer to Scala Center, a non-profit organization. sbt and its subcompoments, including Zinc, will remain available under Apache v2 license.

Updates
Behind the scene

new contributors

Full Changelog: sbt/sbt@v1.9.0...v1.9.1

v1.9.0: 1.9.0

Compare Source

Changes with compatibility implications
  • Deprecates IntegrationTest configuration. See below.
  • Updates underlying Coursier to 2.1.2 by @​eed3si9n.
Deprecation of IntegrationTest configuration

sbt 1.9.0 deprecates IntegrationTest configuration. (RFC-3 proposes to deprecate general use of configuration axis beyond Compile and Test, and this is the first installment of the change.)

The recommended migration path is to create a subproject named "integration", or "foo-integration" etc.

lazy val integration = (project in file("integration"))
  .dependsOn(core) // your current subproject
  .settings(
    publish / skip := true,
    // test dependencies
    libraryDependencies += something % Test,
  )

From the shell you can run:

> integration/test

Assuming these are slow tests compared to the regular tests, I might not aggregate them at all from other subprojects, and maybe only run it on CI, but it's up to you.

Why deprecate IntegrationTest? IntegrationTest was a demoware for the idea of custom configuration axis, and now that we are planning to deprecate the mechanism to simplify sbt, we wanted to stop advertising it. We won't remove it during sbt 1.x series, but deprecation signals the non-recommendation status.

This was contributed by @​eed3si9n and @​mdedetrich in lm#414/#​7261.

POM consistency of sbt plugin publishing

sbt 1.9.0 publishes sbt plugin to Maven repository in a POM-consistent way. sbt has been publishing POM file of sbt plugins as sbt-something-1.2.3.pom even though the artifact URL is suffixed as sbt-something_2.12_1.0. This allowed "sbt-something" to be registered by Maven Central, allowing search. However, as more plugins moved to Maven Central, it was considered that keeping POM consisntency rule was more important, especially for corporate repositories to proxy them.

sbt 1.9.0 will publish using both the conventional POM-inconsistent style and POM-consistent style so prior sbt releases can still consume the plugin. However, this can be opted-out using sbtPluginPublishLegacyMavenStyle setting.

This fix was contributed by Adrien Piquerez (@​adpi2) at Scala Center in coursier#2633, sbt#7096 etc. Special thanks to William Narmontas (@​ScalaWilliam) and Wudong Liu (@​wudong) whose experimental plugin sbt-vspp paved the way for this feature.

sbt new, a text-based adventure

sbt 1.9.0 adds text-based menu when sbt new or sbt init is called without arguments:

$ sbt -Dsbt.version=1.9.0-RC2 init
....

Welcome to sbt new!
Here are some templates to get started:
 a) scala/toolkit.local               - Scala Toolkit (beta) by Scala Center and VirtusLab
 b) typelevel/toolkit.local           - Toolkit to start building Typelevel apps
 c) sbt/cross-platform.local          - A cross-JVM/JS/Native project
 d) scala/scala-seed.g8               - Scala 2 seed template
 e) playframework/play-scala-seed.g8  - A Play project in Scala
 f) playframework/play-java-seed.g8   - A Play project in Java
 g) scala-js/vite.g8                  - A Scala.JS + Vite project
 i) holdenk/sparkProjectTemplate.g8   - A Scala Spark project
 m) spotify/scio.g8                   - A Scio project
 n) disneystreaming/smithy4s.g8       - A Smithy4s project
 q) quit
Select a template (default: a):

Unlike Giter8, .local template creates build.sbt etc in the current directory, and reboots into an sbt session.

This was contributed by Eugene Yokota (@​eed3si9n) in #​7228.

Actionable diagnostics steps

sbt 1.9.0 adds actions to Problem, allowing the compiler to suggest code edits as part of the compiler warnings and errors in a structual manner.

See Roadmap for actionable diagnostics for more details. The changes were contributed by @​ckipp01 in #​7242 and @​eed3si9n in bsp#527/#​7251/zinc#1186 etc.

releaseNotesURL setting

sbt 1.9.0 adds releaseNotesURL setting, which creates info.releaseNotesUrl property in the POM file. This will then be used by Scala Steward. See
Add release notes URLs to your POMs for details.

This was contributed by Arman Bilge in lm#410.

Other updates
Behind the scene

v1.8.3: 1.8.3

Compare Source

Security fix
IO.withTemporaryFile fix

sbt 1.8.3 fixes sbt.io.IO.withTemporaryFile etc not limiting access on Unix-like systems. Prior to this patch release, some functions were using java.io.File.createTempFile, which does not set strict file permissions, as opposed to the NIO-equivalent that does.

This means that on a shared Unix-like systems, build user or plugin's use of sbt.io.IO.withTemporaryFile etc would have exposed the information to other users.

This issue was reported by Oleksandr Zolotko at IBM, and was fixed by Eugene Yokota (@​eed3si9n) in io#344/zinc#1185.

Other updates

sbt 1.8.3 backports Zinc and IO fixes from 1.9.0-RC2 as well.

v1.8.2: 1.8.2

Compare Source

updates

v1.8.1: 1.8.1

Compare Source

Bug fixes

Updates

New Contributors

Full Changelog: sbt/sbt@v1.8.0...v1.8.1

v1.8.0: 1.8.0

Compare Source

Security fixes

  • Updates to Coursier 2.1.0-RC1 to address CVE-2022-37866
  • Updates to Ivy 2.3.0-sbt-a8f9eb5bf09d0539ea3658a2c2d4e09755b5133e to address CVE-2022-37866

Changes with compatibility implications

  • Updates to Scala 2.12.17 + Scala compiler 2.12.17, which upgrades to scala-xml 2.x #​7021

Bug fixes

Other updates

  • Adds long classpath support on JDK 9+ via argument file (opt out using -Dsbt.argsfile=false or SBT_ARGSFILE environment variable) #​7010 by @​easel
  • Adds out-of-box ZIO Test support #​7053 by @​987Nabil
  • Adds support for newly introduced buildTarget/outputPaths method of Build Server Protocol. #​6985 by @​povder

New Contributors

Full Changelog: sbt/sbt@v1.7.1...v1.8.0

v1.7.3: 1.7.3

Compare Source

updates

new contributors

Full Changelog: sbt/sbt@v1.7.2...v1.7.3

v1.7.2: 1.7.2

Compare Source

See https://github.com/sbt/sbt/releases/tag/v1.7.0 for the details on sbt 1.7.x.

v1.7.1: 1.7.1

Compare Source

See https://github.com/sbt/sbt/releases/tag/v1.7.0 for the details on sbt 1.7.x.

Bug fix

Full Changelog: sbt/sbt@v1.7.0...v1.7.1

v1.7.0: 1.7.0

Compare Source

Changes with compatibility implications
++ command updates

Prior to sbt 1.7 ++ <sv> <command1> filtered subprojects using crossScalaVersions having the same ABI suffix as <sv>. This behavior was generally not well understood, and also created incorrect result for Scala 3.x since ++ 3.0.1 test could downgrade subproject that may require 3.1 or above.

sbt 1.7.0 fixes this by requiring ++ <sv> <command1> so <sv> part can be given as a semantic version selector expression, such as 3.1.x or 2.13.x. Note that the expression may match at most one Scala version to switch into. In sbt 1.7.0, a concrete version such as ++ 3.0.1 equires exact version to be present in crossScalaVersion.

This contribution was a collaborated effort among Arnout Engelen #​6894, Rui Gonçalves lm#400, and Eugene Yokota.

Scala 3 compiler error improvements

In zinc#1082, Toshiyuki Takahashi contributed a fix to ignore Problem#rendered passed from the compiler when sbt uses position mapper to transform the position. This is aimed at fixing the error reporting for Play on Scala 3.

In #​6874, Chris Kipp extended xsbti.Problem to track richer information available in Scala 3. This is aimed at enhancing the compilation errors reported to BSP client such as Metals.

BSP updates
Other updates

v1.6.2: 1.6.2

Compare Source

License

sbt 1.6.2 adds License object that defines predefined license values:

licenses := List(License.Apache2)

Predefined values are License.Apache2, License.MIT, License.CC0, and License.GPL3_or_later. lm#395 by @​eed3si9n

v1.6.1: 1.6.1

Compare Source

v1.6.0: 1.6.0

Compare Source

Changes with compatibility implications
BSP improvements
Zinc improvements
Remote caching improvements

sbt 1.6.0 improves remote caching of resources directory by virtualizing the internal sync state (copy-resources.txt). This allows incremental resource directory synching to be resumed from the remote cache, similar to how Zinc has been able to resume incremental compilation from the remote cache. This was contributed by Amina Adewusi (@​Nirvikalpa108) as #​6611.

Dependency tree improvements
Other updates

v1.5.8: 1.5.8

Compare Source

  • sbt 1.5.8 updates log4j 2 to 2.17.0, which fixes a denial of service vulnerability caused by infinite recursion (CVE-2021-45105) #​6755 by @​augi

v1.5.7: 1.5.7

Compare Source

v1.5.6: 1.5.6

Compare Source

v1.5.5: 1.5.5

Compare Source

v1.5.4: 1.5.4

Compare Source

  • Fixes compiler ClassLoader list to use compilerJars.toList (For Scala 3, this drops support for 3.0.0-M2) #​6538 by @​adpi2
  • Fixes undercompilation of package object causing "Symbol 'type X' is missing from the classpath" zinc#983 by @​retronym
  • Fixes overcompilation with scalac -release flag zinc#982 by @​retronym
  • Fixes BSP on ARM Macs by keeping JNI server socket to keep using JNI ipcsocket#14 by @​quelgar
  • Fixes build/exit notification not closing BSP channel #​6539 by @​adpi2
  • Fixes POM file's Maven repository ID character restriction to match that of Maven lm#380 by @​peter-janssen

v1.5.3: 1.5.3

Compare Source

Configuration

📅 Schedule: Branch creation - "on the 1st through 7th day of the month" in timezone America/Los_Angeles, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

@renovate renovate bot added the bot label Aug 1, 2023
@keynmol keynmol merged commit 12bda37 into main Aug 24, 2023
@keynmol keynmol deleted the renovate/sbt-sbt-1.x branch August 24, 2023 10:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@keynmol keynmol keynmol approved these changes

Assignees
No one assigned
Labels
bot
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@keynmol