chore(deps): bump the scala group across 1 directory with 2 updates

[dependabot]

Bumps the scala group with 2 updates in the /scala directory: org.scalameta:sbt-scalafmt and org.scala-sbt:sbt.

Updates org.scalameta:sbt-scalafmt from 2.5.6 to 2.6.2

Updates org.scala-sbt:sbt from 1.9.9 to 1.13.0

Release notes

Sourced from org.scala-sbt:sbt's releases.

1.13.0

⚠️ Remote code execution vulnerability fix

sbt team received a security report GHSA-943m-f264-54p4 from @​stasimus that when the serverConnectionType is set to Tcp, an attacker is able to execute arbitrary code remotely via BSP, similar to a recent bug that was found in JSON-RPC. sbt 1.13.0 and 2.0.7 fix this bug.

Builds with the default serverConnectionType are not affected. In affected builds, we recommend removing the serverConnectionType setting, or upgrading to a patched version or later. In an affected build, the setting might look like this:

Global / serverConnectionType := ConnectionType.Tcp

The remediation was implemented by @​stasimus.

🚀 updates

• Scala 3.9 REPL support by @​Gedochao in sbt/sbt#9564
• IO.jarParallel and IO.zipParallel by @​hoangmaihuy in sbt/io#540

🐛 bug fixes

• fix: Avoid rewriting unchanged plugin descriptors by @​unkarjedy in sbt/sbt#9613
• fix: Fixes -V parsing in sbt runners by @​anatoliykmetyuk in sbt/sbt#9626

behind the scenes

• ci: Remove cla-checker v1 by @​eed3si9n in sbt/sbt#9572
• Update sbtn to 2.0.0-8753a981 by @​eed3si9n in sbt/sbt#9635
• Bump IO to 1.13.0 by @​eed3si9n in sbt/sbt#9648

new contributors

• @​Gedochao made their first contribution in sbt/sbt#9564

Full Changelog: sbt/sbt@v1.12.15...v1.13.0

1.12.15

⚠️ Remote code execution vulnerability fix

sbt team received a security report GHSA-m2pw-22cj-jq4v from @​arpitjain099 that when the serverConnectionType is set to Tcp, an attacker is able to execute arbitrary code remotely via the sbt server. sbt 1.12.15 and 2.0.6 fix this bug.

We recommend removing the serverConnectionType setting, or upgrading to a patched version or later:

Global / serverConnectionType := ConnectionType.Tcp

The remediation was implemented by @​eed3si9n and @​anatoliykmetyuk.

🐛 bug fixes

• bport: Fixes sbt runner parsing build.properties with whitespaces by @​anatoliykmetyuk in sbt/sbt#9374

... (truncated)

Commits

• 415d9df sbt 1.13.0
• 4ee14dd Merge pull request #9648 from eed3si9n/wip/bump-io
• 3d4341e [1.x] Bump IO to 1.13.0
• a0a9478 [1.x] fix: disable BSP over TCP and gate requests before auth
• decbda0 [1.x] fix: Fixes -V parsing in sbt runners (#9626) (#9637)
• db8de16 [1.x] Update sbtn to 2.0.0-8753a981 (#9635)
• e98cd1f [1.x] fix: Avoid rewriting unchanged plugin descriptors (#9612) (#9613)
• f8e7c8b [1.x] ci: Remove cla-checker v1 (#9570) (#9572)
• 7662053 [1.x] Fix Scala 3.9.x console crash by loading all JLine jars together (#9564)
• fa5f2f1 sbt 1.12.15
• Additional commits viewable in compare view

[krrrr38]

@dependabot recreate