Scala Newsの情報
8月10日(月)
Fixing a remote execution vulnerability in sbt
This post covers work done under the Sovereign Tech Fund investment umbrella: sbt 2 Stable Release and Maintenance . The work is coordinated by the Scala Center . TL;DR Only builds that explicitly set serverConnectionType are affected. You can remove the setting from your build, or upgrade to sbt 1.12.15 / sbt 2.0.6 or later by putting the following in project/build.properties : sbt . version = 1.12 . 15 Note that installing a new sbt command does not affect the sbt version used by each individual build. The vulnerability As part of our ongoing work on the sbt 2 release, we’ve been reviewing…
6月5日(金)
Scala 3.8.4 is now available!
Release highlights Security audit fixes Scala 3.8.4 includes improvements and fixes for issues discovered during the Scala codebase security audit carried out in collaboration with the Open Source Technology Improvement Fund and Quarkslab. Notable fixes in this release include: Hardened TASTy parsing to prevent infinite loops on maliciously crafted files ( #25676 ) Fixed a stored XSS vulnerability in Scaladoc ( #25681 ) Improved error handling in scala.sys.process.Parser.tokenize ( #25675 ) Fixed TastyPrinter’s JAR-walking logic to include subdirectories ( #25678 ) :help syntax for all compil…
6月1日(月)
Scala Codebase Security Audit Complete
This post covers work done under the Sovereign Tech Fund investment umbrella: Maintenance of the Standard Library/Core Library Modules and APIs . The work is coordinated by the Scala Center . The Scala Center is proud to share the first results of the security audit of Scala carried out in collaboration with Open Source Technology Improvement Fund and the security researchers at Quarkslab . The audit was divided into two major parts: an assessment of the Scala 3 compiler and Scala standard library codebases, and a separate review of Scala’s supply-chain security. This first publication focuse…
3月31日(火)
Fixing a Command Injection Vulnerability in sbt
This post covers work done under the Sovereign Tech Fund investment umbrella: sbt 2 Stable Release and Maintenance . The work is coordinated by the Scala Center . As part of our ongoing work on the sbt 2 release, we’ve been reviewing and hardening core parts of the sbt codebase. During that work, we discovered a command injection vulnerability in how sbt resolves source dependencies on Windows. The issue has been assigned CVE-2026-32948 , rated Moderate (CVSS 6.7), and is now fixed. If you use sbt on Windows, update to sbt 1.12.8 or sbt 2.0.0-RC10 or later to apply the fix. The vulnerability…