build(deps): bump org.scala-sbt:sbt from 1.13.0 to 2.0.9

[dependabot]

Bumps org.scala-sbt:sbt from 1.13.0 to 2.0.9.

Release notes

Sourced from org.scala-sbt:sbt's releases.

2.0.9

🐛 bug fixes

• fix: Fixes AccessDeniedException on Windows by creating JAR in situ by @​eed3si9n in sbt/io#558
• fix: Fixes unhermetic semanticdbTargetRoot in the compile cache key by @​christianharrington in sbt/sbt#9711
• fix: Fixes pipelined build with Java sources by @​anatoliykmetyuk in sbt/sbt#9574
• fix: Keep macro subprojects off the pipelined classpath by @​stasimus in sbt/sbt#9719
• fix: Fixes sbt runner script not starting on openSUSE by @​alexasl in sbt/sbt#9753
• Update to sbtn 2.1.0-M1 sbt/sbt#9755

Full Changelog: sbt/sbt@v2.0.8...v2.0.9

2.0.8

🐛 bug fixes

• fix: Fixes ThisBuild-scoped bare settings by @​eed3si9n in sbt/sbt#9674
• fix: Fixes TestReportListener not receiving endGroup after a LinkageError by @​unkarjedy in sbt/sbt#9667
• fix: Fixes the ability to extend TestResultLogger by @​unkarjedy in sbt/sbt#9655
• fix: Fixes --addPluginSbtFile getting lost after reboot by @​azdrojowa123 in sbt/sbt#9669
• fix: Fixes JDK 17 domain socket deadlocks by @​eed3si9n in sbt/sbt#9671
• fix: Keep adhoc test classloader open in a forked test @​stasimus in sbt/sbt#9639
• fix: Fixes Windows runner by @​eed3si9n in sbt/sbt#9680

Full Changelog: sbt/sbt@v2.0.7...v2.0.8

2.0.7

⚠️ Remote code execution vulnerability fix

sbt team received a security report GHSA-943m-f264-54p4 from @​stasimus that when the serverConnectionType is set to Tcp, an attacker is able to execute arbitrary code remotely via BSP, similar to a recent bug that was found in JSON-RPC. sbt 1.13.0 and 2.0.7 fix this bug.

Builds with the default serverConnectionType are not affected. In affected builds, we recommend removing the serverConnectionType setting, or upgrading to a patched version or later. In an affected build, the setting might look like this:

Global / serverConnectionType := ConnectionType.Tcp

The remediation was implemented by @​stasimus.

🚀 updates

• perf: Stop re-converting the classpath in compileOptions by @​hoangmaihuy in sbt/sbt#9622

🐛 bug fixes

• fix: Guard diskcache against path traversal by @​eed3si9n in sbt/sbt#9605
• fix: Name the platform in CrossVersion(module, scalaModuleInfo) by @​kitbellew in #9620
• fix: Avoid rewriting unchanged plugin descriptors by @​unkarjedy in sbt/sbt#9624
• fix: Fixes scalacOptions in BSP using VirtualFileRef by @​azdrojowa123 in sbt/sbt#9610
• fix: Fixes -V parsing in sbt runners by @​anatoliykmetyuk in sbt/sbt#9626
• fix: Fixes filesystem traversal order affecting cache stability by @​christianharrington in #9646

... (truncated)

Commits

• 6165811 Merge pull request #9759 from eed3si9n/bport2/bport
• 82560d3 [2.0.x] Update sbtn to 2.1.0-M1 (#9755)
• 56b20c2 [2.0.x] IO 1.13.2
• cee3208 [2.0.x] fix: Fix sbt runner script not starting on openSUSE (#9753)
• 1bde2c0 [2.0.x] fix: keep macro subprojects off the pipelined classpath (#9719)
• 621df16 [2.x] fix: virtualize semanticdbTargetRoot in the compile cache key (#9711)
• fb1183e [2.0.x] Cache pipelined Java compilation
• 2500707 [2.0.x] Fix Java output when export pipelining is disabled
• 3127e8d sbt 2.0.8
• 039b3db Merge pull request #9673 from eed3si9n/bport2/bport
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies, sbt. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

Benchmark A/B

❌ benchmark job failed

base: success, head: failure — sbt Jmh/run failed (compile error on that side? see the run logs)

No comparison available — this is an explicit failure state, not a pass.

[kryptt]

Declining for now — this is hard-blocked upstream, not by our build: sbt-typelevel (ci-release / settings / site 0.8.7) has no sbt-2 cross-build at any version (typelevel/sbt-typelevel#899, itself waiting on Laika#774 and an sbt-gpg sbt-2 build), so plugin resolution fails before the build definition compiles. Everything else already cross-publishes _sbt2_3 at the pinned versions, and a stripped probe showed the codebase itself is sbt-2-clean (full sbt compile + root sbt test 786 examples, 0 failures, on JDK 25). Worth re-opening when sbt-typelevel#899 ships a release; the only known mechanical fallout then is two url(...) → uri(...) deprecations in build.sbt and rewriting the typelevel-coupled workflow steps.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.