Update dependency sbt/sbt to v2.0.8

[renovate]

This PR contains the following updates:

Package	Update	Change
sbt/sbt	patch	2.0.6 → 2.0.8

---

Release Notes

sbt/sbt (sbt/sbt)

v2.0.8: 2.0.8

Compare Source

🐛 bug fixes

• fix: Fixes ThisBuild-scoped bare settings by @​eed3si9n in #​9674
• fix: Fixes TestReportListener not receiving endGroup after a LinkageError by @​unkarjedy in #​9667
• fix: Fixes the ability to extend TestResultLogger by @​unkarjedy in #​9655
• fix: Fixes --addPluginSbtFile getting lost after reboot by @​azdrojowa123 in #​9669
• fix: Fixes JDK 17 domain socket deadlocks by @​eed3si9n in #​9671
• fix: Keep adhoc test classloader open in a forked test @​stasimus in #​9639
• fix: Fixes Windows runner by @​eed3si9n in #​9680

Full Changelog: sbt/sbt@v2.0.7...v2.0.8

v2.0.7: 2.0.7

Compare Source

⚠️ Remote code execution vulnerability fix

sbt team received a security report GHSA-943m-f264-54p4 from @​stasimus that when the serverConnectionType is set to Tcp, an attacker is able to execute arbitrary code remotely via BSP, similar to a recent bug that was found in JSON-RPC. sbt 1.13.0 and 2.0.7 fix this bug.

Builds with the default serverConnectionType are not affected. In affected builds, we recommend removing the serverConnectionType setting, or upgrading to a patched version or later. In an affected build, the setting might look like this:

Global / serverConnectionType := ConnectionType.Tcp

The remediation was implemented by @​stasimus.

🚀 updates

• perf: Stop re-converting the classpath in compileOptions by @​hoangmaihuy in #​9622

🐛 bug fixes

• fix: Guard diskcache against path traversal by @​eed3si9n in #​9605
• fix: Name the platform in CrossVersion(module, scalaModuleInfo) by @​kitbellew in #​9620
• fix: Avoid rewriting unchanged plugin descriptors by @​unkarjedy in #​9624
• fix: Fixes scalacOptions in BSP using VirtualFileRef by @​azdrojowa123 in #​9610
• fix: Fixes -V parsing in sbt runners by @​anatoliykmetyuk in #​9626
• fix: Fixes filesystem traversal order affecting cache stability by @​christianharrington in #​9646

behind the scenes

• ci: Remove cla-checker v1 by @​eed3si9n in #​9571
• Update sbtn to 2.0.0-8753a981 by @​eed3si9n in #​9630

Full Changelog: sbt/sbt@v2.0.6...v2.0.7

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.