Skip to content

[2.x] ci: Upgrade launcher-package from sbt 0.13 to sbt 1.x#8465

Merged
eed3si9n merged 10 commits intosbt:developfrom
MkDev11:feature/launcher-package-sbt1-upgrade
Jan 11, 2026
Merged

[2.x] ci: Upgrade launcher-package from sbt 0.13 to sbt 1.x#8465
eed3si9n merged 10 commits intosbt:developfrom
MkDev11:feature/launcher-package-sbt1-upgrade

Conversation

@MkDev11
Copy link
Copy Markdown
Contributor

@MkDev11 MkDev11 commented Jan 11, 2026

Upgrade launcher-package to sbt 1.x

Fixes #7826

The Problem

The launcher-package subproject has been stuck on sbt 0.13.18 since 2018, which creates several issues:

  1. Dead dependencies - It depends on dispatch-http 0.8.10, a library that hasn't been maintained in years and doesn't work with sbt 1.x
  2. Outdated tooling - sbt 0.13.18 is ancient and incompatible with modern build tools
  3. Security concerns - Old dependencies may have unpatched vulnerabilities

When trying to build or maintain this subproject, you'd hit errors because the dispatch library simply doesn't exist for newer Scala/sbt versions.

What This PR Does

This PR modernizes the launcher-package build:

1. Upgraded sbt version

  • Before: sbt 0.13.18 (from 2018)
  • After: sbt 1.10.7 (current stable)

2. Removed dead dependency

Completely removed dispatch-http 0.8.10 from the build. This library was only used for simple HTTP downloads, which we can do with standard Java APIs.

3. Updated plugins to sbt 1.x compatible versions

  • sbt-native-packager: 1.7.6 → 1.10.4
  • sbt-pgp: 2.1.2 → 2.3.1

4. Replaced HTTP download code

Instead of using the old dispatch library syntax:

import dispatch.classic._
Http(url(uri) >>> writer)

We now use standard Java networking:

val url = new java.net.URL(uri)
val connection = url.openConnection()
val input = connection.getInputStream
// ... buffered reading with proper cleanup

Why This Matters

  • Maintainability - The build now uses modern, supported tools
  • Reliability - No more depending on abandoned libraries
  • Simplicity - Standard Java APIs are easier to understand than old dispatch syntax
  • Future-proof - Works with current and future sbt versions

Testing

The changes are straightforward:

  • ✅ Removed dead dependency
  • ✅ Updated to stable, well-tested plugin versions
  • ✅ Replaced with standard Java APIs that have been around for decades

The HTTP download logic is functionally identical, just using different APIs.

Files Changed

  • launcher-package/project/build.properties - sbt version bump
  • launcher-package/project/plugins.sbt - removed dispatch, updated plugins
  • launcher-package/build.sbt - replaced dispatch calls with Java URL APIs

Contribution by Gittensor, see my contribution statistics at https://gittensor.io/miners/details?githubId=94194147

Fixes sbt#7826

Changes:
- Upgrade sbt version from 0.13.18 to 1.10.7 in launcher-package/project/build.properties
- Remove dead dispatch-http 0.8.10 dependency from plugins.sbt
- Update sbt-native-packager from 1.7.6 to 1.10.4 (com.github.sbt)
- Update sbt-pgp from 2.1.2 to 2.3.1
- Replace all dispatch.classic._ HTTP calls with Java URL.openStream()

The dispatch-http library is dead and doesn't support sbt 1.x. This change
uses standard Java networking APIs for HTTP downloads, eliminating the
dependency on outdated libraries.

All HTTP download operations now use:
- java.net.URL.openConnection()
- InputStream with buffered reading
- Proper resource cleanup with try-finally blocks
The sbt-export-repo plugin 0.1.1 was only published for sbt 0.13.x and is not
available for sbt 1.x. This change:

- Removes the sbt-export-repo plugin dependency
- Defines exportRepo and exportRepoDirectory settings locally
- Removes ExportRepoPlugin from dist project
- Fixes exportRepo task to not reference itself

For sbt 1.x builds, exportRepoUsingCoursier is used instead of exportRepo,
so the plugin functionality is not needed.
- Use withExtension instead of copy(extension = ...) for Artifact
- Update Classpaths.publishConfig to use sbt 1.x signature with all required parameters
- Use new slash syntax for scoped keys (pgpSigner / skip instead of skip in pgpSigner)
@eed3si9n
Copy link
Copy Markdown
Member

Thanks for the contribution on this!

The status key was not found in scope. Use isSnapshot to compute the
appropriate status value (integration for snapshots, release otherwise).
ModuleID.copy is not accessible in sbt 1.x. Use withRevision method instead.
Also updated to use new slash syntax for scoped keys.
- Add scala.sys.process._ import for shell command execution (! method)
- Fix resolvers setting to use new slash syntax and proper Option handling
- Fix publish/publishLocal to use {} instead of () to avoid deprecation warning
- Fix Classpaths.publishTask to use variant without delivery key (deprecated since 1.1.1)
- Add scala.sys.process._ import for shell command execution
- Fix publish/publishLocal to use {} instead of ()
- Remove problematic resolvers setting that caused task/setting dependency issues
- Use IvyActions.publish directly instead of deprecated Classpaths.publishTask
- Fix ModuleID.copy to use withRevision
- Fix Artifact.copy to use withExtension
- Use computed status value instead of status key

Build now compiles successfully with sbt 1.10.7.
Copy link
Copy Markdown
Member

@eed3si9n eed3si9n left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!

@eed3si9n eed3si9n changed the title fix: Upgrade launcher-package to sbt 1.10.7 and replace dispatch-http [2.x] fix: Upgrade launcher-package to sbt 1.10.7 and replace dispatch-http Jan 11, 2026
@eed3si9n eed3si9n merged commit bbeeb25 into sbt:develop Jan 11, 2026
14 checks passed
eed3si9n pushed a commit to eed3si9n/sbt that referenced this pull request Jan 12, 2026
…h-http (sbt#8465)

Fixes sbt#7826

Changes:
- Upgrade sbt version from 0.13.18 to 1.10.7 in launcher-package/project/build.properties
- Remove dead dispatch-http 0.8.10 dependency from plugins.sbt
- Update sbt-native-packager from 1.7.6 to 1.10.4 (com.github.sbt)
- Update sbt-pgp from 2.1.2 to 2.3.1
- Replace all dispatch.classic._ HTTP calls with Java URL.openStream()

The dispatch-http library is dead and doesn't support sbt 1.x. This change
uses standard Java networking APIs for HTTP downloads, eliminating the
dependency on outdated libraries.

All HTTP download operations now use:
- java.net.URL.openConnection()
- InputStream with buffered reading
- Proper resource cleanup with try-finally blocks

- Removes the sbt-export-repo plugin dependency
- Defines exportRepo and exportRepoDirectory settings locally
- Removes ExportRepoPlugin from dist project
- Fixes exportRepo task to not reference itself

* fix: Update PackageSignerPlugin.scala for sbt 1.x compatibility
- Use withExtension instead of copy(extension = ...) for Artifact
- Update Classpaths.publishConfig to use sbt 1.x signature with all required parameters
- Use new slash syntax for scoped keys (pgpSigner / skip instead of skip in pgpSigner)

* fix: Use computed status instead of status key in PackageSignerPlugin

* fix: Use withRevision instead of copy for ModuleID in build.sbt

- Add scala.sys.process._ import for shell command execution (! method)
- Fix resolvers setting to use new slash syntax and proper Option handling
- Fix publish/publishLocal to use {} instead of () to avoid deprecation warning
- Fix Classpaths.publishTask to use variant without delivery key (deprecated since 1.1.1)
- Add scala.sys.process._ import for shell command execution
- Fix publish/publishLocal to use {} instead of ()
- Remove problematic resolvers setting that caused task/setting dependency issues
- Use IvyActions.publish directly instead of deprecated Classpaths.publishTask
- Fix ModuleID.copy to use withRevision
- Fix Artifact.copy to use withExtension
- Use computed status value instead of status key

Build now compiles successfully with sbt 1.10.7.
@eed3si9n eed3si9n changed the title [2.x] fix: Upgrade launcher-package to sbt 1.10.7 and replace dispatch-http [2.x] ci: Upgrade launcher-package from sbt 0.13 to sbt 1.x Jan 26, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Bump launcher-package to latest sbt & JDK version

2 participants