diff --git a/main/src/main/scala/sbt/Defaults.scala b/main/src/main/scala/sbt/Defaults.scala
index be0fb5a42..d5085ad8f 100755
--- a/main/src/main/scala/sbt/Defaults.scala
+++ b/main/src/main/scala/sbt/Defaults.scala
@@ -2548,6 +2548,14 @@ object Classpaths {
     }
   }
 
+  private[sbt] def warnInsecureProtocol(ress: Seq[Resolver], log: Logger): Unit = {
+    ress.foreach(_.validateProtocol(log))
+  }
+  // this warns about .from("http:/...") in ModuleID
+  private[sbt] def warnInsecureProtocolInModules(mods: Seq[ModuleID], log: Logger): Unit = {
+    mods.foreach(_.validateProtocol(log))
+  }
+
   private[sbt] def defaultProjectID: Initialize[ModuleID] = Def.setting {
     val base = ModuleID(organization.value, moduleName.value, version.value)
       .cross(crossVersion in projectID value)
@@ -2573,10 +2581,12 @@ object Classpaths {
       new IvySbt(ivyConfiguration.value, CustomHttp.okhttpClient.value)
     }
   def moduleSettings0: Initialize[Task[ModuleSettings]] = Def.task {
+    val deps = allDependencies.value.toVector
+    warnInsecureProtocolInModules(deps, streams.value.log)
     ModuleDescriptorConfiguration(projectID.value, projectInfo.value)
       .withValidate(ivyValidate.value)
       .withScalaModuleInfo(scalaModuleInfo.value)
-      .withDependencies(allDependencies.value.toVector)
+      .withDependencies(deps)
       .withOverrides(dependencyOverrides.value.toVector)
       .withExcludes(allExcludeDependencies.value.toVector)
       .withIvyXML(ivyXML.value)
@@ -3203,6 +3213,7 @@ object Classpaths {
       val (rs, other) = (fullResolvers.value.toVector, otherResolvers.value.toVector)
       val s = streams.value
       warnResolversConflict(rs ++: other, s.log)
+      warnInsecureProtocol(rs ++: other, s.log)
       InlineIvyConfiguration()
         .withPaths(ivyPaths.value)
         .withResolvers(rs)
diff --git a/main/src/main/scala/sbt/coursierint/LMCoursier.scala b/main/src/main/scala/sbt/coursierint/LMCoursier.scala
index 4d7a896fe..9e762148d 100644
--- a/main/src/main/scala/sbt/coursierint/LMCoursier.scala
+++ b/main/src/main/scala/sbt/coursierint/LMCoursier.scala
@@ -91,6 +91,7 @@ object LMCoursier {
     val sbtScalaOrganization = "org.scala-lang" // always assuming sbt uses mainline scala
     val userForceVersions = Inputs.forceVersions(depsOverrides, scalaVer, scalaBinaryVer)
     Classpaths.warnResolversConflict(rs, log)
+    Classpaths.warnInsecureProtocol(rs, log)
     CoursierConfiguration()
       .withResolvers(rs.toVector)
       .withInterProjectDependencies(interProjectDependencies.toVector)
diff --git a/project/Dependencies.scala b/project/Dependencies.scala
index b5bcf9d1c..7bbe8f4f0 100644
--- a/project/Dependencies.scala
+++ b/project/Dependencies.scala
@@ -10,12 +10,12 @@ object Dependencies {
   def nightlyVersion: Option[String] = sys.props.get("sbt.build.version")
 
   // sbt modules
-  private val ioVersion = nightlyVersion.getOrElse("1.3.0-M16")
-  private val utilVersion = nightlyVersion.getOrElse("1.3.0-M10")
+  private val ioVersion = nightlyVersion.getOrElse("1.3.0-M17")
+  private val utilVersion = nightlyVersion.getOrElse("1.3.0-M11")
   private val lmVersion =
     sys.props.get("sbt.build.lm.version") match {
       case Some(version) => version
-      case _             => nightlyVersion.getOrElse("1.3.0-M6")
+      case _             => nightlyVersion.getOrElse("1.3.0-M8")
     }
   val zincVersion = nightlyVersion.getOrElse("1.3.0-M9")