changes with compatibility implications

• Hides Ivy-dependent projectDescriptors key by @eed3si9n in #8959
• Rejects java.io.File as cached task output type by @speedcoder430 in #8766

🚀 updates

• deps: Update metabuild to Scala 3.8.2 by @xuwei-k in #8805
• deps: Update to Coursier 2.1.25-M24 by @eed3si9n + @bitloi in #8962
• feat: Add dependencyMode setting to control classpath transitivity by @eureka928 in #8960
• feat: XDG directory standard by @bitloi in #8769 + #8780
• feat: client-side run env inheritance by @aviu16 in #8752
• feat: repositories_force support by @bitloi in #8761
• feat: Add allowMismatchScala setting by @dev-miro26 in #8804
• feat: Tweak the prompt by @eed3si9n in #8877
• feat: Experimental sbtw launcher by @bitloi in #8742
• feat: Pretty-print dependency lock file by @spider-yamet in #8773
• feat: Adds VF keys such as sourcesVF by @eed3si9n in #8915
• feat: Use sbt runner in BSP config by @bittoby in #8920

🐛 bug fixes

• fix: Harden Windows VCS URI fragments against command injection by @anatoliykmetyuk in #8970 + #8982
• fix: Make task caching more robust by @idanbenzvi in #8890
• fix: Fixes unresolved dependency error for Coursier by @bitloi in #8869
• fix: Fixes NoClassDefFoundError during analysis of inner classes by @BrianHotopp in sbt/zinc#1660
• fix: Relax non-delegation for settings on shell by @bitloi in #8751
• fix: Support inline comments in .jvmopts and .sbtopts files by @njlazzar-su in #8758
• fix: Resolve virtual file refs in scaladoc options by @speedcoder430 in #8768
• fix: Respect scalaOrganization in compiler bridge resolution by @tanishiking in #8732
• fix: Prefer direct key selection over aggregate-only fallback by @it-education-md in #8775
• fix: Non-fork test classloader respects autoScalaLibrary by @bitloi in #8776
• fix: Fixes Aggregation.printSettings pattern matching by @xuwei-k in #8790
• fix: Fixes java++ tab completion by @bitloi in #8778
• fix: Respect last plugin toggle for enablePlugins/disablePlugins by @it-education-md in #8794
• fix: Remove -Dsbt.global.base in runner script by @eed3si9n in #8795
• Revert "[2.x] fix: Handle JVM parameters with spaces in dot files by @eed3si9n in #8797
• fix: Fixes double quotes handling in fork mode, take 2 by @BrianHotopp in #8765
• fix: Fixes comments in dot files by @eed3si9n in #8841
• fix: Fixes sbt runner script's sbtn detection by @fireXtract in #8810
• fix: Fixes lazy val name handling in Eval by @xuwei-k in #8818
• fix: Fixes Global / onChangedBuildSource := IgnoreSourceChanges by @seroperson in #8820
• fix: Print server stderr on startup failure by @eureka928 in #8816
• fix: Fixes support comma-separated imports in build.sbt by @RenzoMXD in #8829
• fix: Fixes undefined per-project settings order by @seroperson in #8862
• fix: Fixes TaskConvert.appExpr by @xuwei-k in #8899
• fix: Fixes -mem option handling in sbtn by @rockchris99 in #8831

behind the scenes

• ci: Update onLoadMessage by @xuwei-k in #8754
• ci: Update mima settings by @xuwei-k in #8753
• ci: Update sbt plugins by @xuwei-k in #8771
• refactor: Fix warnings. Avoid copyArrayToImmutableIndexedSeq by @xuwei-k in #8781
• refactor: Fix raw types in java file by @xuwei-k in #8782
• refactor: Remove unnecessary nowarn annotation by @xuwei-k in #8784
• refactor: Add tailrec annotations by @xuwei-k in #8785
• refactor: Use foreachEntry instead of foreach if Map by @xuwei-k in #8787
• refactor: Use enum instead of scala.Enumeration in sbt.Execute.State by @xuwei-k in #8788
• refactor: Use collectFirst instead of collect and headOption by @xuwei-k in #8789
• refactor: Use minBy instead of sortBy and head by @xuwei-k in #8792
• refactor: Remove redundant conversions by @xuwei-k in #8786
• refactor: Remove unnecessary asInstanceOf by @xuwei-k in #8791
• refactor: Use foreach instead of map by @xuwei-k in #8793
• refactor: Use new wildcard syntax in test by @xuwei-k in #8807
• refactor: Avoid old varargs splice syntax in test by @xuwei-k in #8806
• feat: Runner script to fail on JDK < 17 for sbt 2.x by @eureka928 in #8825
• sbtn 1.12.5 by @eed3si9n in #8860
• deps: Update semanticdbVersion in SemanticdbPlugin.scala by @xuwei-k in #8885
• deps: Zinc 2.0.0-M15 by @eed3si9n in #8981

new contributors

• @aviu16 made their first contribution in #8752
• @njlazzar-su made their first contribution in #8758
• @BrianHotopp made their first contribution in #8765
• @speedcoder430 made their first contribution in #8768
• @dev-miro26 made their first contribution in #8804

Full Changelog: v2.0.0-RC9...v2.0.0-RC10

updates

• fix: Fixes the source dependency checkout directory by @eed3si9n in #8974

behind the scenes

• fix: Fixes test format by @eed3si9n in #8969

Full Changelog: v1.12.7...v1.12.8

CVE-2026-32948 Source dependency feature (via crafted VCS URL) leading to arbitrary code execution on Windows

sbt 1.12.7 fixes CVE-2026-32948 (GHSA-x4ff-q6h8-v7gw). Recently @anatoliykmetyuk at Scala Center discovered a vulnerability in sbt's source dependency feature ProjectRef(...) and RootProject(...). The URL for the version control system allows branch specification via the URL fragment, which is passed to Windows cmd shell. A malicious user can craft an URL that allows arbitrary code execution.

Anatolii also provided a fix from a private fork 1ce945 and 3a474a. We recommend upgrading to sbt 1.12.7, especially if you're on Windows.

updates

• Revert Coursier back to 2.12.24 (#8902) by @eed3si9n in #8918

Full Changelog: v1.12.6...v1.12.7

updates

• deps: Update lm-coursier to 2.1.12 (Coursier 2.12.25-M24) by @majk-p in #8902
• feat: Retry on HTTP 5xx during dependency resolution by @majk-p in coursier/sbt-coursier#601
• deps: Update log4j to 2.25.3 by @eed3si9n in #8872
• deps: Update semanticdbVersion in SemanticdbPlugin.scala by @xuwei-k in #8885

Full Changelog: v1.12.5...v1.12.6

updates

• bport: sbt runner should fail on JDK < 17 for sbt 2.x by @eureka928 in #8825
• bport: sbtn prints out the error if server fails to start by @eureka928 in #8816

🐛 bug fixes

• bport: Fixes double quotes handling in JVM argfile by @BrianHotopp in #8765
• bport: Fixes sbt runner comment handling in .sbtopts and .javaopts files by @eed3si9n in #8841
• bport: Fixes sbt runner's sbtn detection by @fireXtract in #8810

Full Changelog: v1.12.4...v1.12.5

• backport: Respect scalaOrganization in compiler bridge resolution by @tanishiking in #8799
• backport: Fixes .jvmopts parse error on Windows Git Bash by reverting "Handle JVM parameters with spaces in dot files" by @eed3si9n in #8798

Full Changelog: v1.12.3...v1.12.4

changes with compatibility implications

• Disables delegation of scoped settings and tasks on shell by @eed3si9n in #8539

🚀 updates

JDK 17 + Scala 3.8.1 in metabuild

sbt 2.0.0-RC9 upgrades the Scala version used on the metabuild to Scala 3.8.1 after notifying the community in the users forum. This means that you would need JDK 17 or later to run sbt 2.x.

This was contributed by @eed3si9n in #8530.

Maven BOM (Bill of Materials) usage support

sbt 2.0.0-RC9 adds Maven BOM (Bill of Materials) usage support. Subprojects can depend on published BOM artifacts using .pomOnly():

libraryDependencies += ("com.fasterxml.jackson" % "jackson-bom" % "2.21.0").pomOnly()

These bill of materials are forwarded to Coursier via via Resolve.addBom(), which should introduce version constraints for specific libraries (such as Jackson). You can use "*" to declare versionless dependency:

libraryDependencies += "com.fasterxml.jackson.core" % "jackson-core" % "*"

This will let Coursier automatically fill in the version based on the bill of material constraints (in this case "2.21.0").

This feature was contributed by @bitloi in #8675.

client-side console

Similar to the client-side run, sbt 2.0.0 implements the ability to send console (Scala REPL) back to the sbtn, which forks a fresh JVM to run the REPL. All you have to do is:

sbt console

One of the aims of running this on the client-side is to avoid blocking the sbt server.

This was contributed by @eed3si9n and @calm329 in #8604, #8677, #8705, #8722.

rootProject macro

sbt 2.0.0-RC9 support rootProject macro:

lazy val root = rootProject
  .autoAggregate

This is a shortcut for (project in file(".")), which tends to a boilerplate in build.sbt. This was contributed by @bitloi in #8671.

experimental: Dependency lock

sbt 2.0.0-RC9 adds an experimental support for dependency locking.

sbt dependencyLock

This will generate deps.lock files in the base directory of each subproject. When a lock file is present, Coursier resolution is no longer called. This ensures reproducible builds across different machines and CI environments.

sbt dependencyLockCheck

dependencyLockCheck validates that the lock file is up-to-date.

This feature was contributed by @MkDev11 in #8581 / #8744.

experimental: Ivyless publishing

sbt 1.x internally uses Apache Ivy for publishing; sbt 2.0.0-RC9 introduces experimental Ivyless publishing.

useIvy := false

This will use Ivyless implementation for publishLocal and publish. ixy.xml file generation uses Coursier.

This was contributed by @calm329 and @bitloi in #8634, #8686, #8692

test-related changes

• feat: testOnly supports ... as a wildcard pattern @ByteForge in #8577
• feat: Adds testForkedParallelism setting for forked test parallelism by @MkDev11 in #8453
• feat: The root-level testOnly is changed to a command so it fails when no test classes match by @calm329 in #8607
• feat: Scripted should fail when no tests match the pattern by @gayanMatch in #8457
• fix: Fixes explicitlySpecified and selectors for testOnly by @Eruis2579 in #8727

other updates

• Adds "3-latest.candidate" support for Scala 3 release candidates by @calm329 in #8596
• Report eviction errors for Test dependencies by @calm329 in #8451
• Notify sbtn client when command is queued by @bitloi in #8568
• Drops other idle servers on client exit by @calm329 in #8701
• Allow system JNA on OpenBSD by making jna.nosys conditional by @calm329 in #8452
• Set terminal window title during run by @MkDev11 in #8492
• Cache failed compilation to avoid repeated failures by @MkDev11 in #8490
• Adds csrLocalArtifactsShouldBeCached setting for caching local artifacts by @MkDev11 in #8504
• Adds dependencyLicenseInfo by @saber04414 in #8506
• Adds GitHub setup-java action support in CrossJava by @MkDev11 in #8574
• Adds scriptedKeepTempDirectory setting by @bitloi in #8621
• Adds per-channel project cursor for sbtn by @bitloi in #8649

🐛 bug fixes

runner script-related fixes

• fix: Fixes the IDE debugger option on Windows by @MkDev11 in #8440
• fix: Fixes --sbt-version option handling by @Angel98518 in #8446
• fix: Fixes sbt --client new combination by @MkDev11 in #8512
• fix: Fixes sbt new argument parsing on Windows by @MkDev11 in #8509
• fix: Fixes sbtopts files priority in sbt runner by @mohansinghi in #8514
• fix: Fixes -X support on Windows batch runner by @GlobalStar117 in #8566
• fix: Fixes the handling of special characters in dot files by @circlecrystalin in #8558
• fix: Fixes runner script precedence over .sbtopts by @it-education-md in #8695
• fix: Handle paths with parentheses in sbt.bat on Windows by @Pandaman in #8656
• fix: Handle JVM parameters with spaces in dot files by @Eruis2579 in #8730

other fixes

• fix: Restores Scala 2 reflect/compiler unification by @calm329 in #8700 / #8733
• fix: Makes libraryClassName relation deterministic under concurrency by @lihaoyi in sbt/zinc#1638
• fix: Invalidates update cache across commands when dependencies change by @calm329 in #8501
• fix: Handles relocated dependencies in dependencyTree by @calm329 in #8489
• fix: Adds symlink optimization to ActionCache.get by @tellorian + @MkDev11 + @azdrojowa123 in #8456 / #8479 / #8461 / #8716
• fix: Allow dependencyTree to run despite eviction errors by @eureka928 in #8554
• fix: Prevents server boot when --no-server is used by @SmartDever02 in #8444
• fix: Skips interactive prompt in batch mode when project loading by @Francluob in #8447
• fix: Applies dependencyOverrides to delivered Ivy XML by @MkDev11 in #8463
• fix: Filters out JAR paths in BSP diagnostics on Windows by @MkDev11 in #8482
• fix: Fixes ProjectMatrix invalid project ID with CrossVersion.full by @byteforge38 in #8484
• fix: Fixes updateSbtClassifiers using wrong Scala version for cross-built plugins by @calm329 in #8495
• fix: Allows ++ command to accept projects not in current state by @MkDev11 in #8505
• fix: Fixes pipelining flags applied to unsupported Scala versions by @0xsatoshi99 in #8499
• fix: Uses strict matching for scala-library JAR detection by @MkDev11 in #8507
• fix: Fixes StackOverflowError when reporting self-referencing exceptions by @MkDev11 in #8508
• fix: Fixes --no-colors setting for sbtn by @gayanMatch in #8517
• fix: Fixes command logs by @SalesforcePeak in #8515
• fix: Fixes whatDependsOn error by @Dairus01 in #8462
• fix: Trim whitespaces from sbt.version in build.properties by @0xsatoshi99 in #8524
• fix: Fixes watchTriggers to control what triggers by @mohansinghi in #8525
• fix: Fixes inputFileChanges with nested task scopes by @MkDev11 in #8516
• fix: Preserves user-defined scalacOptions in doc task scope by @MkDev11 in #8528
• fix: Starts server when explicitly requested via BSP/thin client by @MkDev11 in #8529
• fix: Propagates SBT_OPTS to BSP config by @MkDev11 in #8531
• fix: Prevents test from hanging when forked process crashes by @MkDev11 in #8536
• fix: Logs server response body on publish failure by @MkDev11 in #8537
• fix: Skips checksums for PGP signature files (.asc) by @Dairus01 in #8535
• fix: Fixes NullPointerException on exit by @SmartDever02 in https://github.com/s...

updates

• fix/bport: Restores Scala 2 reflect/compiler unification by @calm329 in #8707
• fix/bport: Print warning about scala-reflect not found by @eed3si9n in #8733
• fix/bport: Restore runner precedence over .sbtopts by @it-education-md in #8695
• fix/bport: Handle JVM parameters with spaces in dot files by @Eruis2579 in #8730
• fix/bport: Handle --script-version sbt 2.x project dirs by @Eruis2579 in #8715
• fix/bport: Handle --version in sbt 2.x project dirs by @it-education-md in #8735
• fix/bport: Require coreutils for RPM by @eed3si9n in #8712

Full Changelog: v1.12.2...v1.12.3

updates

• Bump to sbtn 1.12.1 by @eed3si9n in #8684
• Use JProcess for interactive forking, which improves terminal detection by @eed3si9n in #8678
• fix: Handle paths with parentheses in sbt.bat on Windows by @Eruis2579 in #8682 / #8656

Full Changelog: v1.12.1...v1.12.2

bug fixes

• fix: Fixes sbt --client new combination by @MkDev11 in #8512
• fix: Fixes sbt new argument parsing on Windows by @MkDev11 in #8509
• fix: Fixes sbtopts files priority in sbt runner script by @mohansinghi in #8520
• fix: Fixes -X support on Windows batch runner by @GlobalStar117 in #8566
• fix: Fixes missing project directory on --addPluginSbtFile command by @azdrojowa123 in #8583
• fix: Invalidates update cache across commands when dependencies change by @calm329 in #8593
• fix: Fixes scala-reflect not found problem when Scala 3.8.1 is used transitively by @eed3si9n in #8633

behind the scenes

• ci: Upgrade launcher-package from sbt 0.13 to 1.x by @MkDev11 in #8493

Full Changelog: v1.12.0...v1.12.1