build(deps): bump the sbt group across 1 directory with 6 updates

[dependabot]

Bumps the sbt group with 6 updates in the / directory:

Package	From	To
io.netty:netty-tcnative-boringssl-static	2.0.74.Final	2.0.83.Final
org.apache.httpcomponents.client5:httpclient5	5.4.2	5.6.4
com.eed3si9n:sbt-assembly	2.3.1	2.5.0
org.scalameta:sbt-scalafmt	2.6.0	2.6.2
org.scala-sbt:sbt	1.12.9	2.0.8
org.scala-lang:scala3-library_3	3.8.3	3.9.0

Updates io.netty:netty-tcnative-boringssl-static from 2.0.74.Final to 2.0.83.Final

Commits

• 6d8ec05 [maven-release-plugin] prepare release netty-tcnative-parent-2.0.83.Final
• 9c0ab42 Fix double DeleteLocalRef call which results in UB (#1001)
• 3bf8d04 [maven-release-plugin] prepare for next development iteration
• 9ef1af7 [maven-release-plugin] prepare release netty-tcnative-parent-2.0.82.Final
• 5575e03 Add NULL check to guard against SIGSERV (#999)
• a4c20b5 Pin github actions to reduce risk (#1000)
• bbe7446 Make the Linux artifacts loadable on musl (Alpine) again (#997)
• 990751e Delete local references as soon as possible in callbacks (#996)
• 2e39099 Delete local references while processing the loop to fill the singature algor...
• 6ad94b7 [maven-release-plugin] prepare for next development iteration
• Additional commits viewable in compare view

Updates org.apache.httpcomponents.client5:httpclient5 from 5.4.2 to 5.6.4

Changelog

Sourced from org.apache.httpcomponents.client5:httpclient5's changelog.

Release 5.6.4

This maintenance release fixes SSL parameter application in the async TLS upgrade strategy.

Change Log

• BearerScheme to reject control characters in bearer token. Contributed by Javid Khan

• Corrects application of SSL parameters in the async TLS upgrade method. Contributed by Oleg Kalnichevski

Release 5.6.3

This maintenance release fixes a resource management defect in the content decompression protocol handler of the classic transport.

Change Log

• ContentCompressionExec fails to close the underlying response stream in case of an unexpected runtime or protocol exception. Contributed by Oleg Kalnichevski

• Do not call the backend when an only-if-cached request cannot be served from cache (RFC 9111 5.2.1.7). Contributed by hunghh.dev <hunghh.dev at gmail.com>

• Include the request scheme in redirect same-authority check. Contributed by Javid Khan

• Escape quotes and strip line breaks in RFC 7578 multipart parameters. Contributed by Javid Khan

• HTTPCLIENT-2426: Do not wrap a discarded (null) response body in a content decoder. Contributed by Arturo Bernal

Release 5.6.2

This maintenance release upgrades HttpCore to the latest stable version and restores lazy content decompression by the classic client transport.

... (truncated)

Commits

• 36508ce HttpClient 5.6.4 release
• 59b3d2e Updated release notes for HttpClient 5.6.4 release
• c0af759 reject control characters in bearer token in BearerScheme
• 2422b6c Corrects application of SSL parameters in the async TLS upgrade method
• 66452ea Upgraded HttpClient version to 5.6.4-SNAPSHOT
• 58728b1 Updated release notes for HttpClient 5.6.3 release
• 55733f4 ContentCompressionExec fails to close the underlying response stream in case ...
• 2485ddf Do not call the backend when an only-if-cached request cannot be served from ...
• 26ece37 compare scheme in redirect same-authority check
• 8cdf6fa escape quotes and strip line breaks in rfc7578 multipart parameters
• Additional commits viewable in compare view

Updates com.eed3si9n:sbt-assembly from 2.3.1 to 2.5.0

Updates org.scalameta:sbt-scalafmt from 2.6.0 to 2.6.2

Updates org.scala-sbt:sbt from 1.12.9 to 2.0.8

Release notes

Sourced from org.scala-sbt:sbt's releases.

2.0.8

🐛 bug fixes

• fix: Fixes ThisBuild-scoped bare settings by @​eed3si9n in sbt/sbt#9674
• fix: Fixes TestReportListener not receiving endGroup after a LinkageError by @​unkarjedy in sbt/sbt#9667
• fix: Fixes the ability to extend TestResultLogger by @​unkarjedy in sbt/sbt#9655
• fix: Fixes --addPluginSbtFile getting lost after reboot by @​azdrojowa123 in sbt/sbt#9669
• fix: Fixes JDK 17 domain socket deadlocks by @​eed3si9n in sbt/sbt#9671
• fix: Keep adhoc test classloader open in a forked test @​stasimus in sbt/sbt#9639
• fix: Fixes Windows runner by @​eed3si9n in sbt/sbt#9680

Full Changelog: sbt/sbt@v2.0.7...v2.0.8

2.0.7

⚠️ Remote code execution vulnerability fix

sbt team received a security report GHSA-943m-f264-54p4 from @​stasimus that when the serverConnectionType is set to Tcp, an attacker is able to execute arbitrary code remotely via BSP, similar to a recent bug that was found in JSON-RPC. sbt 1.13.0 and 2.0.7 fix this bug.

Builds with the default serverConnectionType are not affected. In affected builds, we recommend removing the serverConnectionType setting, or upgrading to a patched version or later. In an affected build, the setting might look like this:

Global / serverConnectionType := ConnectionType.Tcp

The remediation was implemented by @​stasimus.

🚀 updates

• perf: Stop re-converting the classpath in compileOptions by @​hoangmaihuy in sbt/sbt#9622

🐛 bug fixes

• fix: Guard diskcache against path traversal by @​eed3si9n in sbt/sbt#9605
• fix: Name the platform in CrossVersion(module, scalaModuleInfo) by @​kitbellew in #9620
• fix: Avoid rewriting unchanged plugin descriptors by @​unkarjedy in sbt/sbt#9624
• fix: Fixes scalacOptions in BSP using VirtualFileRef by @​azdrojowa123 in sbt/sbt#9610
• fix: Fixes -V parsing in sbt runners by @​anatoliykmetyuk in sbt/sbt#9626
• fix: Fixes filesystem traversal order affecting cache stability by @​christianharrington in #9646

behind the scenes

• ci: Remove cla-checker v1 by @​eed3si9n in sbt/sbt#9571
• Update sbtn to 2.0.0-8753a981 by @​eed3si9n in sbt/sbt#9630

Full Changelog: sbt/sbt@v2.0.6...v2.0.7

2.0.6

⚠️ Remote code execution vulnerability fix

sbt team received a security report GHSA-m2pw-22cj-jq4v from @​arpitjain099 that when the serverConnectionType is set to Tcp, an attacker is able to execute arbitrary code remotely via the sbt server. sbt 1.12.15 and 2.0.6 fix this bug.

... (truncated)

Commits

• 3127e8d sbt 2.0.8
• 039b3db Merge pull request #9673 from eed3si9n/bport2/bport
• 67df6f4 [2.0.x] fix: Fixes Windows runner (#9680)
• 24324be [2.0.x] fix: keep worker classloader open for shutdown hooks (#9639)
• 5cee896 [2.0.x] fix: Fixes ThisBuild-scoped bare settings (#9674)
• c30d16c [2.0.x] fix: Fixes JDK 17 domain socket deadlocks (#9671)
• ee5374c [2.0.x] fix: Fixes --addPluginSbtFile getting lost after reboot (#9669)
• 6085d9e [2.0.x] fix: Restore public test result report types (#9655)
• bfd744b [2.0.x] fix: Notify listeners before LinkageError escapes suites (#9667)
• 6913814 sbt 2.0.7
• Additional commits viewable in compare view

Updates org.scala-lang:scala3-library_3 from 3.8.3 to 3.9.0

Release notes

Sourced from org.scala-lang:scala3-library_3's releases.

3.9.0-RC6

Backported changes

• Revert #26579 and #25126 for binary compatibility #26813
• Preserve GADT constraints until PatternMatcher #26805
• Ignore @throws annotation on non-methods #26802
• Box bounded arguments of HKT result types in Java generic signatures #26787
• Fix issue with reading legal java cyclic signatures #26775
• Bail out of patDef opt for .runtimeChecked, not only @unchecked #26774
• Do not emit Java generic signatures for trait private val setters #26633
• Desugaring: avoid patdef optimization for lazy vals #26770
• Scaladoc: Fix variable expansion #26730

Contributors

Thank you to all the contributors who made this release possible 🎉

According to git shortlog -sn --no-merges 3.9.0-RC6..3.9.0-RC6 these are:

     7	Wojciech Mazur
     6	Patryk Zieliński
     4	Solal Pirelli
     2	Jan Chyb
     1	Rikito Taniguchi

3.9.0-RC5

Backported changes

• Bump Scala CLI to v1.16.0 #26703
• Fix stale baseTypeCache after synthetic Product.Mirror parents added #26714
• Ignore coverage probes in unused update analysis #26711
• Fix crash when unapply returns a Boolean-deriving opaque type #26658
• Emit inline info attribute #26650
• Fix false unused-var warning on self-assignment reads (#26620) #26635
• Stop hiding errors in GenericSignatureVisitor #26632
• Emit a super init call for primitives on the JVM #26630
• Preserve qualifier purity through compiler-generated casts #26579
• Fix regression #26153 (in dotty-cps-async) use typer skolems as inline proxy's type #26563
• Fix a couple issues related to erased value types #26213
• Scaladoc: Remove jquery and hanging javascript assets. #22014
• Scaladoc: add fallback lookup from nearest package #26661
• Fix Scaladoc top package order to be alphabetical #26653
• Fixes #26013: Wrap with->& rewrite in parens for typed patterns #26016
• Make Option.orNull public in binary #26751

... (truncated)

Commits

• 777528f Release Scala 3.9.0 LTS
• 2649f1a Add changelog for 3.9.0
• de4a625 Fix build-msi version extraction
• 46e75f2 Remove winget publishing job (#26654)
• a24919b Generate provenance attestation (#26748)
• 892e4da Make release process forkable (#26595)
• 32baefd Least privilege permissions (#26700)
• a1b0e9c Release Scala 3.9.0-RC6
• 4a9f57c Add changelog for 3.9.0-RC6
• e8c4054 Backport "Fix regression: special case Symbol-less overloaded TermRefs in Inl...
• Additional commits viewable in compare view