Play 2.8.11

The Play Team is happy to announce the releases of Play 2.8.11.

This release brings in a new version of Akka Http including security updates.

📗 What is new?

Following pull requests got merged for this release:

• Update play-json and play-ws #11030 by @octonato
• update play-ws #11028 by @octonato
• use new community sonatype profile #11024 by @octonato
• Fixed ###replace: tag that led to incorrect docs #10789 by @arid-mangoss
• Clarified the allowedhost blacklist usage in documentation #10839 by @FuriousTurtle
• bump guava dependency to fix vulnerability #10875 by @johnduffell
• bump: Akka 2.6.17 and Akka HTTP 10.1.15 for Play 2.8.9 #11019 by @ennru
• Fix IOException when using sbt thin client (backport #10890) #11014 by @mergify
• Remove Whitesource checks #11003 by @ennru
• Travis: remove explicit notifications (backport #10984) #11000 by @mergify
• [2.8x] Fix cron job by upgrading akka + scalaJava8Compat (for Scala 2.13 only) #10966 by @mkurz
• Fix variable substitution in evolution warning (backport #10931) #10960 by @mergify
• Fix cron jobs (repo.akka.io not used anymore) (backport #10961) #10963 by @mergify
• Add play-test to PlayImport (backport #10940) #10959 by @mergify
• Set MaxMetaspaceSize to 512m (like it was 4 month ago) (backport #10877) #10942 by @mergify
• fix: change project starter link (backport #10934) #10935 by @mergify
• Stop testing 0.13 #10932 by @ignasi35
• [2.8.x] Use sbt 1.5.5 for scripted tests #10926 by @mergify
• Update outdated links to scala-sbt.org in the documentation #10918 by @kaseken
• Fix tail-recursive deserializer (Lagom's #3241) (backport #10840) #10916 by @mergify
• Prefer -agentlib:jdwp= over -Xrunjdwp: (backport #10885) #10908 by @mergify
• Run tests against Scala 2.12.14 and 2.13.6 and sbt 1.5.3 (backport #10880) #10891 by @mergify
• Make sure scripted jobs use the same commit like publish-local did (backport #10855) #10872 by @mergify
• [2.8.x] Run scripted tests against sbt 1.5.2 #10856 by @mergify
• [2.8.x] Remove bintray leftovers (fixes CRON build) #10842 by @mkurz
• [2.8.x] Run tests with sbt 1.5.1 #10835 by @mkurz
• Binders for OptionalInt, OptionalLong, OptionalDouble (backport #10825) #10830 by @mergify
• Updated link to OWASP recommended to familiarize with CSRF #10828 by @TrevorNathan
• Also run netty http 1.1 microbenchmark encrypted (backport #10820) #10824 by @mergify
• Fix docs: Flash cookie is signed (bp #10818) #10821 by @mergify
• Initialize static Json objectMapper only once (bp #10808) #10812 by @mergify
• Long jobs should appear first on a stage #10811 by @ignasi35

For more details see the full list of changes and the 2.8.11 milestone.

🙇 Credits

Finally, thanks to the community for their help with detailed bug reports, discussion about new features, and pull requests review. Play is only possible due to the help we had from amazing contributors.

If you find Play useful for work, please consider to support this Open Source project by becoming a backer or premium sponsor. You can donate to our Open Collective here.

Special thanks to the following contributors who helped with this release:

@FuriousTurtle, @PromanSEW, @TrevorNathan, @arid-mangoss, @ennru, @gmethvin, @ignasi35, @johnduffell, @kaseken, @mergify, @mergify[bot], @mkurz, @octonato, @rstento and @scala-steward

Full Changelog: 2.8.8...2.8.11

Play 2.8.8

📣 Play 2.8.8 Released

The Play Team is happy to announce the releases of Play 2.8.8.

📗 What is new?

The following are the relevant changes of this bugfix release:

• Bump akka 2.6.14 #10806 by @ignasi35 which includes the bump to Jackson 2.11.x #10788 by @mergify.
• Add empty parentheses () to generated reverse route method depending on routes file (bp #10671) #10673 by @mergify. This is related to https://github.com/scala/scala/releases/tag/v2.13.3 and will likely introduce compilation errors on your code.
• Play no longer uses Bintray to distribute the sbt plugin #10804 by @ignasi35
• Add support for sbt 1.5.0 (bp #10796) #10799 by @mergify
• Make the routes generated sources reproducible #10735 by @mergify

Following pull requests got merged for this release:

• Bump akka 2.6.14 #10806 by @ignasi35
• Sunset bintray 2.1.x #10804 by @ignasi35
• Fix: Playdevmode compiles twice (requires sbt 1.4+) #10373
• Akka-Http-Server: allow Headers.remove() to remove Content-Type and Content-Length (bp #10797) #10801 by @mergify
• Run scripted tests with sbt 1.5.0 (bp #10796) #10799 by @mergify
• Update netty-transport-native-epoll to 4.1.63.Final (bp #10795) #10798 by @mergify
• Bump Jackson to 2.11.x (bp #10781) #10788 by @mergify
• revert changes to playCommonClassloaderTask since we are using scala 2.12.13 (bp #10782) #10783 by @mergify
• Make public DatabaseEvolutions.databaseEvolutions() (bp #10754) #10779 by @mergify
• [2.8.x] Add release-drafter workflow for 2.8.x branch + docs update #10775 by @mkurz
• [2.8.x] Upgrade dependencies before releasing Play 2.8.8 #10767 by @mkurz
• Update play-file-watch to 1.1.16 (bp #10759) #10761 by @mergify
• [2.8.x] Run scripted tests on sbt 1.4.x + refactoring #10723 by @mkurz
• fix Int overflow in BodyParsers.anyContent(maxLength: Option[Long]) (bp #10741) #10753 by @mergify
• Routes compiler: Remove generation date, keep the source relative (bp #10707) #10735 by @mergify
• Update play-file-watch to 1.1.15 (bp #10736) #10737 by @mergify
• [2.8.x] Support sbt 1.4 virtual files for compilation and config errors #10712 by @mkurz
• gitignore .bsp folder (Build Server Protocol / sbt 1.4) (bp #10631) #10722 by @mergify
• Scala 2.12.13 and 2.13.5 (bp #10718) #10721 by @mergify
• Upgrade akka and akka-http (bp #10717) #10719 by @mergify
• Catch Throwable instead of NonFatal when starting prod server (bp #10690) #10701 by @mergify
• QueryStringBindable.unbind(): Do-do-do URLEncode for all queryString keys! (bp #10370) #10694 by @mergify
• Add type annotation for Optional.empty (bp #10442) #10688 by @mergify
• Java forms should handle "foo[].bar" fields when using subforms (index missing) (bp #10680) #10682 by @mergify
• Java forms: Prefix a ValidationError's key with parent form field key (bp #10666) #10678 by @mergify
• [2.8.x] Support sbt 1.4 virtual files when displaying error source #10649 by @mkurz
• Add empty parentheses () to generated reverse route method depending on routes file (bp #10671) #10673 by @mergify
• Don't reload/(re-)compile or even start an app when shutting down in DEV mode (bp #10661) #10669 by @mergify
• In DEV mode, only set the editor in the error handler if config is valid (bp #10662) #10663 by @mergify
• Fix classloader memory leak, due to ClassTag (bp #10500) #10658 by @mergify
• build: Switch to using javafmtCheckAll (new version) (bp #9960) #10652 by @mergify
• fix DefaultTemporaryFileCreator leak (bp #10498) #10653 by @mergify
• Fix build cache issues (bp #10014) #10651 by @mergify
• Close digest-files in DefaultAssetsMetadata (bp #10639) #10646 by @mergify
• Caffeine Cache Manager - Expose cache names (bp #10637) #10645 by @mergify
• Correct the HostMatcher logic to get host and port (bp #10456) #10632 by @mergify
• shutdown-happy-path: make test more reliable (bp #10598) #10600 by @mergify

For more details see the full list of changes and the 2.8.8 milestone.

🙇 Credits

Special thanks to @mkurz for his continued contributions and insight to push Play forward, and, in this release in particular, for the extra work to make the release come true.

Also, thanks to the community for their help with detailed bug reports, discussion about new features, and pull requests review. Play is only possible due to the help we had from amazing contributors.

Thanks to Lightbend for their continued sponsorship of the Play core team's efforts. Lightbend offers commercial support for Play.

Special thanks to the following contributors who helped with this release:

@Captain1653, @asazernik, @benwaffle, @dwijnand, @eatkins, @gokhanoner, @helllamer, @ignasi35, @jtjeferreira, @marcospereira, @mkurz, @octonato, @pazvanti, @pschichtel, @raboof and @xuwei-k

Play 2.7.9

📣 Play 2.7.9 Released

The Play Team is happy to announce the releases of Play 2.8.7 and Play 2.7.9.

As we found a regression just after building the 2.8.6 and 2.7.8 releases, we followed up on those without announcing them.

📗 What is new?

The following are the relevant changes of this bugfix release:

• Let user overwrite limit memory size on form binding #10543
• The Play Runner now works on Mac OS Big Sur #10372
• We publish a Maven BOM pom.xml for Play 2.8 #10549

For more details see the full list of changes and the 2.7.8 and 2.7.9 milestones.

Migration

To make the form binding size limit configurable, some sources may need adaptation to make the FormBinding implicits available (see Parser maxMemoryBuffer limits).

🙇 Credits

Finally, thanks to the community for their help with detailed bug reports, discussion about new features, and pull requests review. Play is only possible due to the help we had from amazing contributors.

Thanks to Lightbend for their continued sponsorship of the Play core team's efforts. Lightbend offers commercial support for Play.

Play 2.8.7

📣 Play 2.8.7 Released

The Play Team is happy to announce the releases of Play 2.8.7 and Play 2.7.9.

As we found a regression just after building the 2.8.6 and 2.7.8 releases, we followed up on those without announcing them.

📗 What is new?

The following are the relevant changes of this bugfix release:

• Let user overwrite limit memory size on form binding #10543
• The Play Runner now works on Mac OS Big Sur #10372
• We publish a Maven BOM pom.xml for Play 2.8 #10549

For more details see the full list of changes and the 2.8.6 and 2.8.7 milestones.

Migration

To make the form binding size limit configurable, some sources may need adaptation to make the FormBinding implicits available (see Parser maxMemoryBuffer limits).

🙇 Credits

Finally, thanks to the community for their help with detailed bug reports, discussion about new features, and pull requests review. Play is only possible due to the help we had from amazing contributors.

Thanks to Lightbend for their continued sponsorship of the Play core team's efforts. Lightbend offers commercial support for Play.

Play 2.8.5

📣 Play 2.8.5 Released

The Play Team is proud to announce the release of Play 2.8.5.

📗 What is new?

The following is the main change of this bugfix release:

• (regression since 2.8.0) Json.toJson is serializing private fields by default for Jackson (#10523). This is potentially a data leak for users handling sensitive data on private fields of classes serialized as JSON.

Other improvements in this release:

• Remove the deprecated FakeKeyStore (#10487)

For more details see the full list of changes and the 2.8.5 milestone.

🙇 Credits

Finally, thanks to the community for their help with detailed bug reports, discussion about new features, and pull requests review. Play 2.8.5 is only possible due to the help we had from amazing contributors.

Thanks to Lightbend for their continued sponsorship of the Play core team's efforts. Lightbend offers commercial support for Play.

Play 2.7.7

📣 Play 2.7.7 Released

The Play Team is proud to announce the release of Play 2.7.7.

📗 What is new?

The following are the main changes of this bugfix release:

• (regression) JsonNode deserializer support for @JsonRawValue as module (#10510)

For more details see the full list of changes and the 2.7.7 milestone.

🙇 Credits

Finally, thanks to the community for their help with detailed bug reports, discussion about new features, and pull requests review. Play 2.7.7 is only possible due to the help we had from amazing contributors.

Thanks to Lightbend for their continued sponsorship of the Play core team's efforts. Lightbend offers commercial support for Play.

Special thanks to the following contributors who helped with this release:

• Renato Cavalcanti
• Ignasi Marimon-Clos

Play 2.8.4

📣 Play 2.8.4 Released

The Play Team is proud to announce the release of Play 2.8.4.

📗 What is new?

The following are the main changes of this bugfix release:

• (regression) JsonNode deserializer support for @JsonRawValue as module (#10508)
• Extend data embedded into the synthetic PlayVersion (#10519)

For more details see the full list of changes and the 2.8.4 milestone.

🙇 Credits

Finally, thanks to the community for their help with detailed bug reports, discussion about new features, and pull requests review. Play 2.8.4 is only possible due to the help we had from amazing contributors.

Thanks to Lightbend for their continued sponsorship of the Play core team's efforts. Lightbend offers commercial support for Play.

Play 2.8.3

📣 Play 2.8.3 Released

The Play Team is proud to announce the release of Play 2.8.3.

📗 What is new?

The following are the main changes of this bugfix release:

• Security Fix - Jsonnode deserializer as module (#10495) - read related CVE announcement
• Security Fix - Json parse on forms (#10495) - read related CVE announcement
• AkkaHttpServer: prevent access to not yet initialized fields (#10323)
• Support injecting default NamedCaffeineCache (#10359)
• Adds ClassActorSystemProvider in the DI (#10382)
• Fixes int binder error message and provides specs (#10413)
• Fix gzip buffering (#10428)

For more details see the full list of changes and the 2.8.3 milestone.

🙇 Credits

Finally, thanks to the community for their help with detailed bug reports, discussion about new features, and pull requests review. Play 2.8.3 is only possible due to the help we had from amazing contributors.

Thanks to Lightbend for their continued sponsorship of the Play core team's efforts. Lightbend offers commercial support for Play.

Special thanks to the following contributors who helped with this release:

• Al-Mothafar Al-Hasan
• Alec Theriault
• Arnout Engelen
• David Pinn
• Geoffrey Yip
• Ignasi Marimon-Clos
• Jacob Wahlgren
• James Roper
• Marcos Pereira
• Matthias Kurz
• Renato Cavalcanti
• Suiyi Fu
• Valy Dia
• Will Sargent
• joe gichuru
• slisaasquatch

Play 2.7.6

📣 Play 2.7.6 Released

The Play Team is proud to announce the release of Play 2.7.6.

📗 What is new?

The following are the main changes of this bugfix release:

• Security Fix - Jsonnode deserializer as module (#10496) - read related CVE announcement
• Security Fix - Json parse on forms (#10496) - read related CVE announcement
• Re-enabling cross compilation for routes-compiler (#10354)
• Fix gzip buffering (#10429)

For more details see the full list of changes and the 2.7.6 milestone.

🙇 Credits

Finally, thanks to the community for their help with detailed bug reports, discussion about new features, and pull requests review. Play 2.8.3 is only possible due to the help we had from amazing contributors.

Thanks to Lightbend for their continued sponsorship of the Play core team's efforts. Lightbend offers commercial support for Play.

Special thanks to the following contributors who helped with this release:

• Arnout Engelen
• Ignasi Marimon-Clos
• Johannes Rudolph
• Play Team
• Renato Cavalcanti
• Sebastien Coquelin

2.8.2

📣 Play 2.8.2 Released

The Play Team is proud to announce the release of Play 2.8.2.

📗 What is new?

The following are the main changes of this bugfix release:

• fix HTTP/2 support for JDK8 after u252 #10274
• fixed CSRF handling for invalid content types #10289
• artifacts for Scala 2.13 are compiled using 2.13.2 #10279
• allow uploading empty files #10113
• file upload temporary folder is unique again#10194
• support compile-time injection of named caches (Caffeine) #10070

For more details see the full list of changes and the 2.8.2 milestone.

🙇 Credits

Finally, thanks to the community for their help with detailed bug reports, discussion about new features, and pull requests review. Play 2.8.2 is only possible due to the help we had from amazing contributors.

Thanks to Lightbend for their continued sponsorship of the Play core team's efforts. Lightbend offers commercial support for Play.

Special thanks to the following contributors who helped with this release:

• Matthias Kurz
• Arnout Engelen
• Suiyi Fu
• Marcos Pereira
• slisaasquatch
• joe gichuru
• Renato Cavalcanti
• Alec Theriault
• Will Sargent
• Al-Mothafar Al-Hasan
• Jacob Wahlgren
• Valy Dia
• David Pinn
• Geoffrey Yip