Update dependency sbt/sbt to v2.0.8

[renovate]

This PR contains the following updates:

Package	Update	Change
sbt/sbt	patch	2.0.6 → 2.0.8

---

Release Notes

sbt/sbt (sbt/sbt)

v2.0.8: 2.0.8

Compare Source

🐛 bug fixes

• fix: Fixes ThisBuild-scoped bare settings by @​eed3si9n in #​9674
• fix: Fixes TestReportListener not receiving endGroup after a LinkageError by @​unkarjedy in #​9667
• fix: Fixes the ability to extend TestResultLogger by @​unkarjedy in #​9655
• fix: Fixes --addPluginSbtFile getting lost after reboot by @​azdrojowa123 in #​9669
• fix: Fixes JDK 17 domain socket deadlocks by @​eed3si9n in #​9671
• fix: Keep adhoc test classloader open in a forked test @​stasimus in #​9639
• fix: Fixes Windows runner by @​eed3si9n in #​9680

Full Changelog: sbt/sbt@v2.0.7...v2.0.8

v2.0.7: 2.0.7

Compare Source

⚠️ Remote code execution vulnerability fix

sbt team received a security report GHSA-943m-f264-54p4 from @​stasimus that when the serverConnectionType is set to Tcp, an attacker is able to execute arbitrary code remotely via BSP, similar to a recent bug that was found in JSON-RPC. sbt 1.13.0 and 2.0.7 fix this bug.

Builds with the default serverConnectionType are not affected. In affected builds, we recommend removing the serverConnectionType setting, or upgrading to a patched version or later. In an affected build, the setting might look like this:

Global / serverConnectionType := ConnectionType.Tcp

The remediation was implemented by @​stasimus.

🚀 updates

• perf: Stop re-converting the classpath in compileOptions by @​hoangmaihuy in #​9622

🐛 bug fixes

• fix: Guard diskcache against path traversal by @​eed3si9n in #​9605
• fix: Name the platform in CrossVersion(module, scalaModuleInfo) by @​kitbellew in #​9620
• fix: Avoid rewriting unchanged plugin descriptors by @​unkarjedy in #​9624
• fix: Fixes scalacOptions in BSP using VirtualFileRef by @​azdrojowa123 in #​9610
• fix: Fixes -V parsing in sbt runners by @​anatoliykmetyuk in #​9626
• fix: Fixes filesystem traversal order affecting cache stability by @​christianharrington in #​9646

behind the scenes

• ci: Remove cla-checker v1 by @​eed3si9n in #​9571
• Update sbtn to 2.0.0-8753a981 by @​eed3si9n in #​9630

Full Changelog: sbt/sbt@v2.0.6...v2.0.7

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.