Ref https://github.com/sbt/sbt/issues/6912
Problem
-------
There's apparently a security issue with OkHttp 3.x,
which I am not really sure how applicable it is to our usage
of OkHttp but it is there.
Solution
--------
Since most of OkHttp-specic usage within LM is for Apache Ivy
downloading, I am going to drop this.
Since `sbt.librarymanagement.Http.http` is a public API,
I am substituting this with Apache HTTP backed implementation.
Fixes https://github.com/sbt/sbt/issues/6210
scodec-bits is published with pvp versionScheme (nice), this means that
we should just evaluate the version portion for pvp-ness, but I was
using `guessSecondSegment` that checks for Scala suffix. That's mistake
1.
`guessSecondSegment` assumes that the Scala suffix uses the given
ScalaModuleInfo, but with 2.13-3 sandwich we can't assume this.
In the reported case, Scala module is 3.0.0-M3 but scodec-bits uses
2.13. So that's mistake 2.
This attempts to correct both the mistakes.
1. Instead of `guessSecondSegment`, this adds a simpler `evalPvp`
function.
2. `guessSecondSegment` just looks for `_2.` or `_3` and ignores the
Scala module.
Fixes sbt/sbt#4595
Ref #290
Ref #280
This is bit of an odd one.
To keep bincompat and also to fix sbt 0.13 compatibility issue we have made `Disabled` companion object extend `Disabled` type.
This actually created a subtle deserialization issue:
```
[error] scala.MatchError: Disabled() (of class sbt.librarymanagement.Disabled$)
[error] at sjsonnew.FlatUnionFormats$$anon$5.write(FlatUnionFormats.scala:220)
[error] at sjsonnew.JsonWriter.addField(JsonFormat.scala:40)
[error] at sjsonnew.JsonWriter.addField$(JsonFormat.scala:37)
[error] at sjsonnew.FlatUnionFormats$$anon$5.addField(FlatUnionFormats.scala:208)
[error] at sjsonnew.Builder.addField(Builder.scala:43)
[error] at sbt.librarymanagement.ModuleIDFormats$$anon$1.write(ModuleIDFormats.scala:46)
```
This is because Contraband generates `flatUnionFormat5[CrossVersion, Disabled, ...]` for all of the subtypes of `CrossVersion`, which uses the runtime type information. Now that `Disabled` object is also in the mix, this created JSON that `CrossVersionFormats` cannot deserialize. This brings the code into src/ so we can write this part manually.
Ref https://github.com/sbt/librarymanagement/pull/280
This is to workaround bincompat error detected by sbt community build.
```
[cats] [error] java.lang.NoSuchMethodError: sbt.librarymanagement.CrossVersion$.Disabled()Lsbt/librarymanagement/Disabled$;
```