Skip to content

1.10.3
Compare
Choose a tag to compare
@eed3si9n eed3si9n released this 19 Oct 16:02
· 59 commits to 1.10.x since this release
v1.10.3
This tag was signed with the committer’s verified signature.
eed3si9n eugene yokota
GPG key ID: 37890E298D9A2BFA
Learn about vigilant mode.
f136f98
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.

Protobuf with potential Denial of Service (CVE-2024-7254)

Zinc 1.10.3 updates protobuf-java library to 3.25.5 to address CVE-2024-7254 / GHSA-735f-pc8j-v9w8, which states that while parsing unknown fields in the Protobuf Java library, a maliciously crafted message can cause a StackOverflow error. Given the nature of how Protobuf is used in Zinc as internal serialization, we think the impact of this issue is minimum. However, security software might still flag this to be an issue while using sbt or Zinc, so upgrade is advised. This issue was originally reported by @gabrieljones and was fixed by @Friendseeker in #1443.

@adpi2 at Scala Center has also configured dependency graph submission to get security alerts in #1448.

Reverting the invalidation of circular-dependent sources

Zinc 1.10.3 reverts the initial invalidation of circular-dependent pairs.

There's been a series of incremental compiler bugs such as "Invalid superClass" and "value b is not a member of A" that would go away after clean. The root cause of these bugs were identified by @smarter (#598 (comment)) and @Friendseeker to be partial compilation of circular-dependent sources where two sources A.scala and B.scala use some constructs from each other.

Zinc 1.10.0 fixed this issue via #1284 by invalidating the circular-dependent pairs together. In other words, if A.scala was changed, it would immediately invalidate B.scala. It turns out, that people have been writing circular-dependent code, and this has resulted in multiple reports of Zinc's over-compilation (#1420, #1461). Given that the invalidation seems to affect the users more frequently than the original bug, we're going to revert the fix for now. We might bring this back with an opt-out flag later on. The revert was contributed by by @lihaoyi in #1462.

Improvement: ParallelGzipOutputStream

Zinc 1.10.0 via #1326 added a new consistent (repeatable) formats for Analysis storage. As a minor optimization, the pull request also included an implementation of ParallelGzipOutputStream, which would reduce the generate file size by 20%, but with little time penalty. Unfortunately, however, we have observed in CI that that the scala.concurrent.Future-based implementation gets stuck in a deadlock. @Ichoran and @Friendseeker have contributed an alternative implementation that uses Java threads directly, which fixes the issue in #1466.

Other updates

Behind the scene

New contributors

Full Changelog: v1.10.2...v1.10.3

Contributors

smarter, eed3si9n, and 7 other contributors
Assets 2
Loading