Noteworthy improvements

• #1228 [3.0.x] Avoid running out of memory when parsing heavily nested arrays or objects (backport #1226) by @mkurz
  • We now limit the maximum allowed nesting depth of JSON structures (arrays, objects, or a mix of both) to 1000.
    This limit can be adjusted using the system property play.json.parser.maxNestingDepth.
    We assume a depth of 1000 should be more than sufficient for virtually all real-world use cases.
    
    This change helps prevent both potential OutOfMemoryErrors and StackOverflowErrors.
    The latter, however, is not a concern for Play JSON, since it already uses a @tailrec-optimized parsing method.
    As a result, Play JSON is not affected by CVE-2025-52999, which specifically addresses StackOverflowError risks.
    This improvement is simply an additional safety measure.

Changes

• #1233 [3.0.x] Patch updates by @mkurz
• #1231 [3.0.x] Fix flaky tests (backport #1229) by @mkurz by @mergify[bot]
• #1228 [3.0.x] Avoid running out of memory when parsing heavily nested arrays or objects (backport #1226) by @mkurz
• #1224 [3.0.x] sbt-jmh 0.4.8 (was 0.4.7) by @scala-steward
• #1219 [3.0.x] sbt-header 5.11.0 (was 5.10.0) by @scala-steward
• #1215 [3.0.x] Patch updates by @mkurz
• #1210 [3.0.x] Bump actions/checkout from 4 to 5 by @dependabot[bot]
• #1201 [3.0.x] Patch updates by @mkurz
• #1198 [3.0.x] Remove frequency from scala steward conf (backport #1143) by @mkurz by @mergify[bot]
• #1195 [3.0.x] Patch updates by @mkurz
• #1167 [3.0.x] sbt-ci-release 1.11.1 (was 1.9.3) by @scala-steward
• #1168 [3.0.x] sbt, scripted-plugin 1.11.2 (was 1.10.11) by @scala-steward

❤️ Thanks to our premium sponsors!

If you find this OSS project useful for work, please consider asking your company to support it by becoming a sponsor.
You can also individually sponsor the project by becoming a backer.

🙇 Thanks to our contributors

Finally, thanks to the community for their help with detailed bug reports, discussions about new features and pull request reviews. This project is only possible due to the help we had from amazing contributors.
Special thanks to all code contributors who helped with this particular release (they are listed below)!

Noteworthy improvements

• #1226 [2.10.x] Avoid running out of memory when parsing heavily nested arrays or objects by @mkurz
  • We now limit the maximum allowed nesting depth of JSON structures (arrays, objects, or a mix of both) to 1000.
    This limit can be adjusted using the system property play.json.parser.maxNestingDepth.
    We assume a depth of 1000 should be more than sufficient for virtually all real-world use cases.
    
    This change helps prevent both potential OutOfMemoryErrors and StackOverflowErrors.
    The latter, however, is not a concern for Play JSON, since it already uses a @tailrec-optimized parsing method.
    As a result, Play JSON is not affected by CVE-2025-52999, which specifically addresses StackOverflowError risks.
    This improvement is simply an additional safety measure.

Changes

• #1232 [2.10.x] Patch updates by @mkurz
• #1230 [2.10.x] Fix flaky tests (backport #1229) by @mkurz by @mergify[bot]
• #1226 [2.10.x] Avoid running out of memory when parsing heavily nested arrays or objects by @mkurz
• #1223 [2.10.x] sbt-jmh 0.4.8 (was 0.4.7) by @scala-steward
• #1218 [2.10.x] sbt-header 5.11.0 (was 5.10.0) by @scala-steward
• #1214 [2.10.x] Patch updates by @mkurz
• #1209 [2.10.x] Bump actions/checkout from 4 to 5 by @dependabot[bot]
• #1200 [2.10.x] Patch updates by @mkurz
• #1197 [2.10.x] Remove frequency from scala steward conf (backport #1143) by @mkurz by @mergify[bot]
• #1194 [2.10.x] Patch updates by @mkurz
• #1164 [2.10.x] sbt-ci-release 1.11.1 (was 1.9.3) by @scala-steward
• #1165 [2.10.x] sbt, scripted-plugin 1.11.2 (was 1.10.11) by @scala-steward

❤️ Thanks to our premium sponsors!

If you find this OSS project useful for work, please consider asking your company to support it by becoming a sponsor.
You can also individually sponsor the project by becoming a backer.

🙇 Thanks to our contributors

Finally, thanks to the community for their help with detailed bug reports, discussions about new features and pull request reviews. This project is only possible due to the help we had from amazing contributors.
Special thanks to all code contributors who helped with this particular release (they are listed below)!

Noteworthy Scala 3 improvements

• #1177 [3.0.x] fix field ordering Scala 3 writes macro (backport #1172) by @xuwei-k by @mergify[bot]

Changes

• #1188 [3.0.x] Patch updates by @mkurz
• #1181 [3.0.x] Add test for field ordering (backport #1042) by @levinson by @mergify[bot]
• #1177 [3.0.x] fix field ordering Scala 3 writes macro (backport #1172) by @xuwei-k by @mergify[bot]
• #1169 [3.0.x] Patch updates by @scala-steward
• #1153 [3.0.x] Patch updates by @scala-steward
• #1145 [3.0.x] Patch updates by @scala-steward
• #1136 [3.0.x] Patch updates by @scala-steward
• #1135 [3.0.x] scalafmt-core 3.9.3 (was 3.8.6) by @scala-steward
• #1125 [3.0.x] Patch updates by @scala-steward
• #1118 [3.0.x] Patch updates by @scala-steward
• #1116 [3.0.x] Fix Dependency Graph action (backport #1114) by @ihostage by @mergify[bot]
• #1111 [3.0.x] Patch updates by @scala-steward
• #1099 [3.0.x] Pin joda-time by @mkurz
• #1097 [3.0.x] Patch updates by @mkurz
• #1081 [3.0.x] Patch updates by @scala-steward
• #1088 [3.0.x] sbt-ci-release 1.9.0 (was 1.6.1) by @scala-steward
• #1070 [3.0.x] Patch updates by @scala-steward
• #1069 [3.0.x] sbt-ci-release 1.6.1 (was 1.5.12) by @scala-steward
• #1064 [3.0.x] Patch updates by @scala-steward
• #1060 [3.0.x] Patch updates by @scala-steward
• #1032 [3.0.x] Switch to 3.0.x branch by @mkurz

❤️ Thanks to our premium sponsors!

If you find this OSS project useful for work, please consider asking your company to support it by becoming a sponsor.
You can also individually sponsor the project by becoming a backer.

🙇 Thanks to our contributors

Finally, thanks to the community for their help with detailed bug reports, discussions about new features and pull request reviews. This project is only possible due to the help we had from amazing contributors.
Special thanks to all code contributors who helped with this particular release (they are listed below)!

Noteworthy Scala 3 improvements

• #1178 [2.10.x] fix field ordering Scala 3 writes macro (backport #1172) by @xuwei-k by @mergify[bot]

Changes

• #1185 [2.10.x] Patch updates by @mkurz
• #1182 [2.10.x] Add test for field ordering (backport #1042) by @levinson by @mergify[bot]
• #1178 [2.10.x] fix field ordering Scala 3 writes macro (backport #1172) by @xuwei-k by @mergify[bot]
• #1166 [2.10.x] Patch updates by @scala-steward
• #1152 [2.10.x] Patch updates by @scala-steward
• #1144 [2.10.x] Patch updates by @scala-steward
• #1134 [2.10.x] Patch updates by @scala-steward
• #1133 [2.10.x] scalafmt-core 3.9.3 (was 3.8.6) by @scala-steward
• #1124 [2.10.x] Patch updates by @scala-steward
• #1117 [2.10.x] Patch updates by @scala-steward
• #1115 [2.10.x] Fix Dependency Graph action (backport #1114) by @ihostage by @mergify[bot]
• #1110 [2.10.x] Patch updates by @scala-steward
• #1098 [2.10.x] Pin joda-time by @mkurz
• #1095 [2.10.x] Patch updates by @mkurz
• #1079 [2.10.x] Patch updates by @scala-steward
• #1087 [2.10.x] sbt-ci-release 1.9.0 (was 1.6.1) by @scala-steward
• #1068 [2.10.x] Patch updates by @scala-steward
• #1067 [2.10.x] sbt-ci-release 1.6.1 (was 1.5.12) by @scala-steward
• #1063 [2.10.x] Patch updates by @scala-steward
• #1053 [2.10.x] Patch updates by @scala-steward

❤️ Thanks to our premium sponsors!

If you find this OSS project useful for work, please consider asking your company to support it by becoming a sponsor.
You can also individually sponsor the project by becoming a backer.

🙇 Thanks to our contributors

Finally, thanks to the community for their help with detailed bug reports, discussions about new features and pull request reviews. This project is only possible due to the help we had from amazing contributors.
Special thanks to all code contributors who helped with this particular release (they are listed below)!

Changes

• #1047 Make format generation idempotent by @reimai
• #1050 Patch updates by @mkurz
• #1048 Patch updates by @scala-steward
• #1043 Bump scalacenter/sbt-dependency-submission from 2 to 3 by @dependabot
• #1036 sbt 1.10.0 (was 1.9.9) by @scala-steward
• #1037 Patch updates by @scala-steward
• #968 Run tests on Java 21 by @mkurz
• #1029 Patch updates by @mkurz
• #1028 Pin dependencies in Scala steward by @mkurz

❤️ Thanks to our premium sponsors!

If you find this OSS project useful for work, please consider asking your company to support it by becoming a sponsor.
You can also individually sponsor the project by becoming a backer.

🙇 Thanks to our contributors

Finally, thanks to the community for their help with detailed bug reports, discussions about new features and pull request reviews. This project is only possible due to the help we had from amazing contributors.
Special thanks to all code contributors who helped with this particular release (they are listed below)!

Changes

• #1052 [2.10.x] Make format generation idempotent (backport #1047) by @reimai
• #1051 [2.10.x] Patch updates by @mkurz
• #1045 [2.10.x] sbt 1.10.0 (was 1.9.9) by @scala-steward
• #1046 [2.10.x] Patch updates by @scala-steward
• #1044 [2.10.x] Bump scalacenter/sbt-dependency-submission from 2 to 3 by @dependabot
• #1034 [2.10.x] Run tests on Java 21 (backport #968) by @mkurz
• #1030 [2.10.x] Patch updates by @mkurz
• #1027 [2.10.x] Pin dependencies in Scala steward by @mkurz

❤️ Thanks to our premium sponsors!

If you find this OSS project useful for work, please consider asking your company to support it by becoming a sponsor.
You can also individually sponsor the project by becoming a backer.

🙇 Thanks to our contributors

Finally, thanks to the community for their help with detailed bug reports, discussions about new features and pull request reviews. This project is only possible due to the help we had from amazing contributors.
Special thanks to all code contributors who helped with this particular release (they are listed below)!

Noteworthy

• #993 Fix #974 – Scala 3 macro cannot find Writes for Seq[Map[String, T]] by @sgodbillon
• #994 Fix #971 – "Exception occurred while executing macro expansion." by @sgodbillon

Changes

• #1025 Dependency upgrades by @mkurz
• #1010 logback-classic 1.5.3 (was 1.4.14) (backport #1004) by @scala-steward
• #1008 sbt-scala-native, scala3lib, ... 0.4.17 (was 0.4.16) by @scala-steward
• #1003 Patch updates by @scala-steward
• #996 Keep using Java 11 for testing and publishing by @mkurz
• #995 Add prefix to Dependabot commit message / PR title by @mkurz
• #991 Bump playframework/.github from 3 to 4 by @dependabot
• #990 Dependabot should upgrade GitHub actions workflows by @mkurz
• #988 Upgrade GitHub action workflows by @mkurz
• #978 Patch updates by @scala-steward

❤️ Thanks to our premium sponsors!

If you find this OSS project useful for work, please consider asking your company to support it by becoming a sponsor.
You can also individually sponsor the project by becoming a backer.

🙇 Thanks to our contributors

Finally, thanks to the community for their help with detailed bug reports, discussions about new features and pull request reviews. This project is only possible due to the help we had from amazing contributors.
Special thanks to all code contributors who helped with this particular release (they are listed below)!

Noteworthy

• #1022 [2.10.x] Fix #974 – Scala 3 macro cannot find Writes for Seq[Map[String, T]] (backport #993) by @sgodbillon
• #1023 [2.10.x] Fix #971 – "Exception occurred while executing macro expansion." (backport #994) by @sgodbillon

Changes

• #1026 [2.10.x] Remove legacy typesafe resolver by @mkurz
• #1014 [2.10.x] scalafmt-core 3.8.1 (was 3.7.17) by @scala-steward
• #1015 [2.10.x] Patch updates by @scala-steward
• #1016 [2.10.x] Add tag [2.10.x] for Steward's pull requests by @ihostage
• #1004 [2.10.x] logback-classic 1.5.3 (was 1.4.14) by @scala-steward
• #1007 [2.10.x] Patch updates by @scala-steward
• #997 [2.10.x] Keep using Java 11 for testing and publishing (backport #996) by @mkurz
• #992 [2.10.x] Bump playframework/.github from 3 to 4 by @dependabot
• #989 [2.10.x] Upgrade GitHub action workflows (backport #988) by @mkurz
• #981 [2.10.x] nscplugin, sbt-scala-native, ... 0.4.17 (was 0.4.16) by @scala-steward
• #983 [2.10.x] Patch updates by @scala-steward

❤️ Thanks to our premium sponsors!

If you find this OSS project useful for work, please consider asking your company to support it by becoming a sponsor.
You can also individually sponsor the project by becoming a backer.

🙇 Thanks to our contributors

Finally, thanks to the community for their help with detailed bug reports, discussions about new features and pull request reviews. This project is only possible due to the help we had from amazing contributors.
Special thanks to all code contributors who helped with this particular release (they are listed below)!

Noteworthy

• #956 Fix #836 - Scala3 macro nesting class by @cchantep
• #961 sbt-scalajs, scalajs-compiler, ... 1.15.0 (was 1.14.0) by @scala-steward

Other changes

• #962 sbt-jmh 0.4.7 (was 0.4.6) by @scala-steward
• #963 Patch updates by @scala-steward
• #957 Never trigger release process via UI, need to push tag by hand always by @mkurz
• #932 sbt-scalajs, scalajs-compiler, ... 1.14.0 (was 1.13.2) by @scala-steward
• #950 Patch updates by @scala-steward

❤️ Thanks to our premium sponsors!

If you find this OSS project useful for work, please consider asking your company to support it by becoming a sponsor.
You can also individually sponsor the project by becoming a backer.

🙇 Thanks to our contributors

Finally, thanks to the community for their help with detailed bug reports, discussions about new features and pull request reviews. This project is only possible due to the help we had from amazing contributors.
Special thanks to all code contributors who helped with this particular release (they are listed below)!

Noteworthy

• #969 [2.10.x] Fix #836 - Scala3 macro nesting class (backport #956) by @cchantep
• #965 [2.10.x] sbt-scalajs, scalajs-compiler, ... 1.15.0 (was 1.14.0) by @scala-steward

Other changes

• #966 [2.10.x] sbt-jmh 0.4.7 (was 0.4.6) by @scala-steward
• #967 [2.10.x] Patch updates by @scala-steward
• #958 [2.10.x] Never trigger release process via UI, need to push tag by hand always by @mkurz
• #940 [2.10.x] sbt-scalajs, scalajs-compiler, ... 1.14.0 (was 1.13.2) by @scala-steward
• #953 [2.10.x] Patch updates by @scala-steward

❤️ Thanks to our premium sponsors!

If you find this OSS project useful for work, please consider asking your company to support it by becoming a sponsor.
You can also individually sponsor the project by becoming a backer.

🙇 Thanks to our contributors

Finally, thanks to the community for their help with detailed bug reports, discussions about new features and pull request reviews. This project is only possible due to the help we had from amazing contributors.
Special thanks to all code contributors who helped with this particular release (they are listed below)!