Bump org.scala-sbt:sbt from 2.0.6 to 2.0.7

[dependabot]

Bumps org.scala-sbt:sbt from 2.0.6 to 2.0.7.

Release notes

Sourced from org.scala-sbt:sbt's releases.

2.0.7

⚠️ Remote code execution vulnerability fix

sbt team received a security report GHSA-943m-f264-54p4 from @​stasimus that when the serverConnectionType is set to Tcp, an attacker is able to execute arbitrary code remotely via BSP, similar to a recent bug that was found in JSON-RPC. sbt 1.13.0 and 2.0.7 fix this bug.

Builds with the default serverConnectionType are not affected. In affected builds, we recommend removing the serverConnectionType setting, or upgrading to a patched version or later. In an affected build, the setting might look like this:

Global / serverConnectionType := ConnectionType.Tcp

The remediation was implemented by @​stasimus.

🚀 updates

• perf: Stop re-converting the classpath in compileOptions by @​hoangmaihuy in sbt/sbt#9622

🐛 bug fixes

• fix: Guard diskcache against path traversal by @​eed3si9n in sbt/sbt#9605
• fix: Name the platform in CrossVersion(module, scalaModuleInfo) by @​kitbellew in #9620
• fix: Avoid rewriting unchanged plugin descriptors by @​unkarjedy in sbt/sbt#9624
• fix: Fixes scalacOptions in BSP using VirtualFileRef by @​azdrojowa123 in sbt/sbt#9610
• fix: Fixes -V parsing in sbt runners by @​anatoliykmetyuk in sbt/sbt#9626
• fix: Fixes filesystem traversal order affecting cache stability by @​christianharrington in #9646

behind the scenes

• ci: Remove cla-checker v1 by @​eed3si9n in sbt/sbt#9571
• Update sbtn to 2.0.0-8753a981 by @​eed3si9n in sbt/sbt#9630

Full Changelog: sbt/sbt@v2.0.6...v2.0.7

Commits

• 6913814 sbt 2.0.7
• 917a785 Merge pull request #9647 from eed3si9n/bport2/bport
• bb8926c [2.0.x] fix: disable BSP over TCP and gate requests before auth
• 81ed7a8 [2.0.x] Update sbtn to 2.0.0-8753a981 (#9630)
• f965e0a [2.0.x] fix: Fixes filesystem traversal order affecting cache stability (#9646)
• 0b18207 [2.0.x] perf: Stop re-converting the classpath in compileOptions (#9622)
• a3c503a [2.0.x] fix: Fixes -V parsing in sbt runners (#9636)
• 8d2e582 [2.0.x] Add a resolvedScalacOptions task that resolves cache placeholders (#9...
• 6893ad9 [2.0.x] fix: Avoid rewriting unchanged plugin descriptors (#9612) (#9624)
• 087513f [2.0.x] fix: Name the platform in CrossVersion(module, scalaModuleInfo) (#9621)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)