## Security fixes

- fix: Gate LSP calls behind auth ([GHSA-m2pw-22cj-jq4v](https://github.com/sbt/sbt/security/advisories/GHSA-m2pw-22cj-jq4v)) by @eed3si9n in https://github.com/sbt/sbt/commit/6365a0723 (released in 2.0.6)
- fix: Harden Windows VCS URI fragments against command injection by @anatoliykmetyuk in https://github.com/sbt/sbt/commit/a9347cf22 (released in 2.0.0)

## 🚀 updates

- feat: sbtn subscription level by @bitloi in https://github.com/sbt/sbt/pull/8796 (released in 2.0.0)
- feat: Add allowMismatchScala setting by @dev-miro26 in https://github.com/sbt/sbt/pull/8804 (released in 2.0.0)
- feat: support passing JVM arguments via -- delimiter in run commands by @RenzoMXD in https://github.com/sbt/sbt/pull/8868 (released in 2.0.0)
- feat: Support --autostart=false and --no-server in sbtn client by @eureka928 in https://github.com/sbt/sbt/pull/8895 (released in 2.0.0)
- Retry on HTTP 5xx during dependency resolution by @majk-p in https://github.com/sbt/sbt/pull/8903 (released in 2.0.0)
- feat: Add dependencyMode setting to control classpath transitivity by @eureka928 in https://github.com/sbt/sbt/pull/8960 (released in 2.0.0)
- feat: Add cacheVersion setting for global cache invalidation by @eureka928 in https://github.com/sbt/sbt/pull/8993 (released in 2.0.0)
- feat: Expose `scripted / excludeFilter` and `scripted / includeFilter` keys for scripted test filtering. by @arashi01 in https://github.com/sbt/sbt/pull/9131 (released in 2.0.0)
- feat: ClassLoaderStrategy.Raw by @eed3si9n in https://github.com/sbt/sbt/pull/9161 (released in 2.0.0)
- Add ForkOptions.connectionTimeout by @xuwei-k in https://github.com/sbt/sbt/pull/9172 (released in 2.0.0)
- feat: Execution log by @eed3si9n in https://github.com/sbt/sbt/pull/9203 (released in 2.0.0)
- Add runner support for execution log by @eed3si9n in https://github.com/sbt/sbt/pull/9237 (released in 2.0.0)
- Allow opt-out of transient warning by @eed3si9n in https://github.com/sbt/sbt/pull/9437 (released in 2.0.4)

## 🐛 Bug fixes

- fix: Fixes double quotes handling in fork mode by @BrianHotopp in https://github.com/sbt/sbt/pull/8765 (released in 2.0.0)
- fix: Refer to universal sbtn in detectNativeClient by @fireXtract in https://github.com/sbt/sbt/pull/8810 (released in 2.0.0)
- fix: Print server stderr on startup failure by @eureka928 in https://github.com/sbt/sbt/pull/8816 (released in 2.0.0)
- Fix lazy val name handling in Eval by @xuwei-k in https://github.com/sbt/sbt/pull/8818 (released in 2.0.0)
- fix: sbt -debug doesn't display loading log by @bitloi in https://github.com/sbt/sbt/pull/8819 (released in 2.0.0)
- fix: IgnoreSourceChanges now works by @seroperson in https://github.com/sbt/sbt/pull/8820 (released in 2.0.0)
- fix: Runner should fail on JDK < 17 for sbt 2.x by @eureka928 in https://github.com/sbt/sbt/pull/8825 (released in 2.0.0)
- fix: support comma-separated imports in build.sbt by @RenzoMXD in https://github.com/sbt/sbt/pull/8829 (released in 2.0.0)
- fix: sbt --client fails if -mem is provided by @chrisrock1124 in https://github.com/sbt/sbt/pull/8831 (released in 2.0.0)
- fix: Fixes double quotes handling in fork mode by @eed3si9n in https://github.com/sbt/sbt/pull/8842 (released in 2.0.0)
- fix: Undefined per-project settings order by @seroperson in https://github.com/sbt/sbt/pull/8862 (released in 2.0.0)
- fix: Unresolved dependency error for Coursier by @bitloi in https://github.com/sbt/sbt/pull/8869 (released in 2.0.0)
- fix: fall back to the onsite task when cache fails by @idanbenzvi in https://github.com/sbt/sbt/pull/8890 (released in 2.0.0)
- fix: use new constructor for CantDownloadModule by @majk-p in https://github.com/sbt/sbt/pull/8905 (released in 2.0.0)
- fix: Skip Conflict when dependency relocations form a cycle by @bitloi in https://github.com/sbt/sbt/pull/8919 (released in 2.0.0)
- fix: Use sbt script in BSP config instead of hardcoded Java path by @bittoby in https://github.com/sbt/sbt/pull/8920 (released in 2.0.0)
- fix: Fixes non-typelevel scalaOrganization by @eed3si9n in https://github.com/sbt/sbt/pull/8945 (released in 2.0.0)
- Fix: strip pipelining scalacOptions before launching the REPL by @corevibe555 in https://github.com/sbt/sbt/pull/8986 (released in 2.0.0)
- fix: Scope dependencyMode filtering to compilation only by @eureka928 in https://github.com/sbt/sbt/pull/8990 (released in 2.0.0)
- fix: resolve virtual path in -Ypickle-write scalac option by @corevibe555 in https://github.com/sbt/sbt/pull/9011 (released in 2.0.0)
- fix: Fixes metabuild reloading by @eed3si9n in https://github.com/sbt/sbt/pull/9019 (released in 2.0.0)
- fix: Fixes pollInterval by @eed3si9n in https://github.com/sbt/sbt/pull/9020 (released in 2.0.0)
- Prefer local ScalaModuleInfo over global config by @kitbellew in https://github.com/sbt/sbt/pull/9028 (released in 2.0.0)
- Fix Scala 3 .previous expansion for unstable path by @tanishiking in https://github.com/sbt/sbt/pull/9041 (released in 2.0.0)
- fix: Fix FileAlreadyExistsException in packageDirectory by @bitloi in https://github.com/sbt/sbt/pull/9047 (released in 2.0.0)
- fix: stack traces suppressed in thin client batch mode by @bittoby in https://github.com/sbt/sbt/pull/9058 (released in 2.0.0)
- hide JDK warnings if JDK 26 or later by @xuwei-k in https://github.com/sbt/sbt/pull/9068 (released in 2.0.0)
- fix: Fixes client-side run status by @eed3si9n in https://github.com/sbt/sbt/pull/9081 (released in 2.0.0)
- Add Test configuration to evictionWarningOptions by @zainab-ali in https://github.com/sbt/sbt/pull/9102 (released in 2.0.0)
- fix: Use rootPaths to replace virtual paths in console and doc scalac options. by @mrdziuban in https://github.com/sbt/sbt/pull/9110 (released in 2.0.0)
- fix: Include platform suffix in Artifact.artifactName by @anatoliykmetyuk in https://github.com/sbt/sbt/pull/9118 (released in 2.0.0)
- fix: Fixes managedScalaInstance false support by @eed3si9n in https://github.com/sbt/sbt/pull/9121 (released in 2.0.0)
- fix: Fixes compilerPlugin(...) to ignore platform by @eed3si9n in https://github.com/sbt/sbt/pull/9135 (released in 2.0.0)
- fix: Remove will-be-ignored warning by @eed3si9n in https://github.com/sbt/sbt/pull/9143 (released in 2.0.0)
- fix: Fix error with "-language:postfixOps" by @xuwei-k in https://github.com/sbt/sbt/pull/9151 (released in 2.0.0)
- fix: Fix build.sbt file loading in subdirs by @eed3si9n in https://github.com/sbt/sbt/pull/9165 (released in 2.0.0)
- Fix console output not appearing with bgRun and run / fork := true by @mrdziuban in https://github.com/sbt/sbt/pull/9166 (released in 2.0.0)
- fix: Adjust the forked test classpath by @eed3si9n in https://github.com/sbt/sbt/pull/9170 (released in 2.0.0)
- fix: Invalidate on JDK version by @eed3si9n in https://github.com/sbt/sbt/pull/9216 (released in 2.0.0)
- fix: Include test arg into hash by @eed3si9n in https://github.com/sbt/sbt/pull/9222 (released in 2.0.0)
- fix: Add regression test by @anatoliykmetyuk in https://github.com/sbt/sbt/pull/9246 (released in 2.0.0)
- fix: Apply dependencyMode filtering to internal project deps by @BrianHotopp in https://github.com/sbt/sbt/pull/9250 (released in 2.0.0)
- Fix duplicate autoplugins packageBin mappings by @anatoliykmetyuk in https://github.com/sbt/sbt/pull/9255 (released in 2.0.0)
- fix: Make custom-scala-org scripted test hermetic by @BrianHotopp in https://github.com/sbt/sbt/pull/9260 (released in 2.0.0)
- fix: Parallelize dependency resolution when no progress bar is rendered by @BrianHotopp in https://github.com/sbt/sbt/pull/9270 (released in 2.0.0)
- fix: Report a missing input file clearly instead of an opaque SerializationException by @BrianHotopp in https://github.com/sbt/sbt/pull/9271 (released in 2.0.0)
- Opt bspBuildTargetOutputPathsItem out of caching by @anatoliykmetyuk in https://github.com/sbt/sbt/pull/9272 (released in 2.0.0)
- fix: Fixes backtick-quoted project handling by @xuwei-k in https://github.com/sbt/sbt/pull/9277 (released in 2.0.0)
- fix: Add warning about trainsient key by @eed3si9n in https://github.com/sbt/sbt/pull/9288 (released in 2.0.0)
- fix: Avoid updateFull by @eed3si9n in https://github.com/sbt/sbt/pull/9290 (released in 2.0.0)
- fix: Fixes publishing platform-specific artifacts (like Scala Native) by @arashi01 in https://github.com/sbt/sbt/pull/9293 (released in 2.0.0)
- fix: ByteStream chunked upload/download by @eed3si9n in https://github.com/sbt/sbt/pull/9298 (released in 2.0.0)
- fix: Fixes cross build caching by @eed3si9n in https://github.com/sbt/sbt/pull/9305 (released in 2.0.0)
- fix: Fixes chunked upload/download by @eed3si9n in https://github.com/sbt/sbt/pull/9318 (released in 2.0.0)
- fix: Fixes console / javaOptions by @eed3si9n in https://github.com/sbt/sbt/pull/9322 (released in 2.0.0)
- Fix #9358: preserve --allow-empty and --sbt-create in sbtArguments by @anatoliykmetyuk in https://github.com/sbt/sbt/pull/9370 (released in 2.0.1)
- fix: Fixes dependency tree rendering on some libraries by @anatoliykmetyuk in https://github.com/sbt/sbt/pull/9371 (released in 2.0.4)
- fix: Fixes runner parsing build.properties with whitespaces by @anatoliykmetyuk in https://github.com/sbt/sbt/pull/9374 (released in 2.0.1)
- Fix publishDiagnostics propagation by @anatoliykmetyuk in https://github.com/sbt/sbt/pull/9376 (released in 2.0.1)
- Fix macro expand for HKT type arguments by @tanishiking in https://github.com/sbt/sbt/pull/9377 (released in 2.0.1)
- fix: Fixes global plugin loading by @eed3si9n in https://github.com/sbt/sbt/pull/9391 (released in 2.0.1)
- fix: Fixes sbt runner openbsd support by @eed3si9n in https://github.com/sbt/sbt/pull/9394 (released in 2.0.1)
- fix: Discard a cancelled task's output backlog on cancel by @BrianHotopp in https://github.com/sbt/sbt/pull/9411 (released in 2.0.2)
- fix: apply ByteStream deadline per-call, not on the memoized stub by @yhefamly in https://github.com/sbt/sbt/pull/9413 (released in 2.0.2)
- fix: Keep the output-flush timer alive across forceFlush by @BrianHotopp in https://github.com/sbt/sbt/pull/9414 (released in 2.0.2)
- Fix ivyless sbt plugin publish cross paths by @anatoliykmetyuk in https://github.com/sbt/sbt/pull/9416 (released in 2.0.2)
- Fix #9343 route pipelined dependencyPicklePath through internalDependencyPicklePath by @anatoliykmetyuk in https://github.com/sbt/sbt/pull/9425 (released in 2.0.2)
- fix sjson downgrade by @anatoliykmetyuk in https://github.com/sbt/sbt/pull/9426 (released in 2.0.2)
- fix: Fixes shutdownall by @eed3si9n in https://github.com/sbt/sbt/pull/9435 (released in 2.0.2)
- scala-dyn-version working again by @eed3si9n in https://github.com/sbt/sbt/pull/9438 (released in 2.0.2)
- fix: Make forked run inherit sbt's working directory by @jozanek in https://github.com/sbt/sbt/pull/9442 (released in 2.0.4)
- fix: Propagate -java-home to a server the thin client starts by @BrianHotopp in https://github.com/sbt/sbt/pull/9448 (released in 2.0.4)
- restore JVM option capability in the launcher config by @anatoliykmetyuk in https://github.com/sbt/sbt/pull/9452 (released in 2.0.3)
- fix: Don't cache environmental (position-less) compile failures by @BrianHotopp in https://github.com/sbt/sbt/pull/9464 (released in 2.0.4)
- fix: Fixes stale resources in test by @eed3si9n in https://github.com/sbt/sbt/pull/9469 (released in 2.0.4)
- fix: Re-extract a declared output directory on cache hit when it is missing by @BrianHotopp in https://github.com/sbt/sbt/pull/9473 (released in 2.0.4)
- clean task cleans sona-staging by @eed3si9n in https://github.com/sbt/sbt/pull/9479 (released in 2.0.4)
- fix: Fixes three test-classloader / jar-handle leaks in the sbt server JVM by @kevin-lee in https://github.com/sbt/sbt/pull/9485 (released in 2.0.4)
- fix: Fixes partial cache restoration by @stasimus in https://github.com/sbt/sbt/pull/9488 (released in 2.0.4)
- fix: Register every Def.declareOutput execution, not one per call site by @BrianHotopp in https://github.com/sbt/sbt/pull/9492 (released in 2.0.4)
- fix: Fixes common settings with extraProjects by @eed3si9n in https://github.com/sbt/sbt/pull/9495 (released in 2.0.4)
- fix: Keep file I/O out of cache-write serialization by @BrianHotopp in https://github.com/sbt/sbt/pull/9496 (released in 2.0.4)
- fix: Complete server teardown before logging so reboot works from sbtn by @BrianHotopp in https://github.com/sbt/sbt/pull/9497 (released in 2.0.4)
- fix: Skip checksum generation for asc file, take 2 by @eed3si9n in https://github.com/sbt/sbt/pull/9499 (released in 2.0.4)
- fix: Fixes scalaCompilerBridgeBin by @eed3si9n in https://github.com/sbt/sbt/pull/9506 (released in 2.0.4)
- fix: Fixes a/build.sbt leakage by @eed3si9n in https://github.com/sbt/sbt/pull/9519 (released in 2.0.5)
- fix: sbt.bat fails to start client/server mode on Windows by @ColOfAbRiX in https://github.com/sbt/sbt/pull/9520 (released in 2.0.5)
- fix: Fixes forked run baseDirectory, take 2 by @eed3si9n in https://github.com/sbt/sbt/pull/9531 (released in 2.0.5)
- fix: Preserve '=' in remote cache header values by @KilianSwissborg in https://github.com/sbt/sbt/pull/9534 (released in 2.0.5)
- fix: Fixes AccessDeniedException issue on Windows by @eed3si9n in https://github.com/sbt/sbt/pull/9538 (released in 2.0.5)
- fix: Complete earlyOutputPing on cache-hit and failed compiles by @BrianHotopp in https://github.com/sbt/sbt/pull/9542 (released in 2.0.5)
- fix: Preserve file timestamp in local diskcache by @eed3si9n in https://github.com/sbt/sbt/pull/9559 (released in 2.0.6)

## ⚡ Performance improvements

- perf: short-circuit --version from build.properties by @bitloi in https://github.com/sbt/sbt/pull/8822 (released in 2.0.0)
- perf: Use bytecodeHash for incremental test by @eed3si9n in https://github.com/sbt/sbt/pull/9146 (released in 2.0.0)
- Improve performance of `ClassStamper` by @mrdziuban in https://github.com/sbt/sbt/pull/9253 (released in 2.0.1)
- perf: Improve incremental test stamper by @eed3si9n in https://github.com/sbt/sbt/pull/9257 (released in 2.0.0)
- Migrate FarmHash usage to xxhash64 by @eed3si9n in https://github.com/sbt/sbt/pull/9267 (released in 2.0.0)
- Optimize incremental test further by @yhefamly in https://github.com/sbt/sbt/pull/9364 (released in 2.0.1)
- perf: Read the resolution's project cache once per report by @hoangmaihuy in https://github.com/sbt/sbt/pull/9522 (released in 2.0.5)
- perf: Stop content-hashing artifacts when writing update caches by @hoangmaihuy in https://github.com/sbt/sbt/pull/9524 (released in 2.0.5)
- perf: Memoize the artifact content hash in LibraryManagementCodec by @takayahilton in https://github.com/sbt/sbt/pull/9563 (released in 2.0.6)

## Behind the scenes

- Update to Coursier 2.1.25-M24 by @eed3si9n in https://github.com/sbt/sbt/pull/8381 (released in 2.0.0)
- Move compiler bridge to Update by @eed3si9n in https://github.com/sbt/sbt/pull/8836 (released in 2.0.4)
- Comments in dot files by @eed3si9n in https://github.com/sbt/sbt/pull/8841 (released in 2.0.0)
- Tweak the prompt by @eed3si9n in https://github.com/sbt/sbt/pull/8876 (released in 2.0.0)
- Update semanticdbVersion in SemanticdbPlugin.scala by @xuwei-k in https://github.com/sbt/sbt/pull/8885 (released in 2.0.0)
- Scala 3.8.3 by @xuwei-k in https://github.com/sbt/sbt/pull/8997 (released in 2.0.0)
- Remove Path type from caching by @eed3si9n in https://github.com/sbt/sbt/pull/9032 (released in 2.0.0)
- refactor: Replace string Array with ju.List by @eed3si9n in https://github.com/sbt/sbt/pull/9138 (released in 2.0.0)
- Bump sbtn to 2.0.0-RC13 by @eed3si9n in https://github.com/sbt/sbt/pull/9140 (released in 2.0.0)
- sjson-new 0.14.0 by @eed3si9n in https://github.com/sbt/sbt/pull/9177 (released in 2.0.0)
- test: Port tests to use lm-coursier by @eed3si9n in https://github.com/sbt/sbt/pull/9205 (released in 2.0.0)
- Update sbtn to 2.0.0-RC14 for timeout fix by @eed3si9n in https://github.com/sbt/sbt/pull/9240 (released in 2.0.0)
- Reimplement FarmHash by @eed3si9n in https://github.com/sbt/sbt/pull/9278 (released in 2.0.0)
- ci: Scalafmt 3.11.1 by @eed3si9n in https://github.com/sbt/sbt/pull/9279 (released in 2.0.0)
- Update to Scala 3.8.4 by @eed3si9n in https://github.com/sbt/sbt/pull/9302 (released in 2.0.0)
- sbtn 2.0.0-f0d2fae4 by @eed3si9n in https://github.com/sbt/sbt/pull/9333 (released in 2.0.0)
- ci: sbt-salad-days by @eed3si9n in https://github.com/sbt/sbt/pull/9360 (released in 2.0.1)
- test: Refactor global plugin test by @eed3si9n in https://github.com/sbt/sbt/pull/9380 (released in 2.0.1)
- Update Coursier to version 2.1.25-M26 by @eed3si9n in https://github.com/sbt/sbt/pull/9393 (released in 2.0.1)
- ivy 2.3.0-sbt-939a7ea82f140cdb1f51dc404bb43e00a8c43b83 by @eed3si9n in https://github.com/sbt/sbt/pull/9423 (released in 2.0.2)
- Tweak server startup message by @eed3si9n in https://github.com/sbt/sbt/pull/9429 (released in 2.0.2)
- sbtn 2.0.0-b4d628dd by @eed3si9n in https://github.com/sbt/sbt/pull/9443 (released in 2.0.2)
- Ivy 2.3.0-sbt-f686954b0021a5c3245766ced0cdaeca8ba2fd7a by @eed3si9n in https://github.com/sbt/sbt/pull/9457 (released in 2.0.3)
- sjson-new 0.15.1 by @eed3si9n in https://github.com/sbt/sbt/pull/9458 (released in 2.0.3)
- sbtn 2.0.0-a0c4773a by @eed3si9n in https://github.com/sbt/sbt/pull/9503 (released in 2.0.4)
- Zinc 2.0.4 by @eed3si9n in https://github.com/sbt/sbt/pull/9508 (released in 2.0.4)
- sbtn 2.0.0-731e6666 by @eed3si9n in https://github.com/sbt/sbt/pull/9545 (released in 2.0.5)