Update dependency org.scala-sbt:sbt-launch to v1.13.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
org.scala-sbt:sbt-launch	1.12.15 → 1.13.0

---

Release Notes

sbt/sbt (org.scala-sbt:sbt-launch)

v1.13.0: 1.13.0

Compare Source

⚠️ Remote code execution vulnerability fix

sbt team received a security report GHSA-943m-f264-54p4 from @​stasimus that when the serverConnectionType is set to Tcp, an attacker is able to execute arbitrary code remotely via BSP, similar to a recent bug that was found in JSON-RPC. sbt 1.13.0 and 2.0.7 fix this bug.

Builds with the default serverConnectionType are not affected. In affected builds, we recommend removing the serverConnectionType setting, or upgrading to a patched version or later. In an affected build, the setting might look like this:

Global / serverConnectionType := ConnectionType.Tcp

The remediation was implemented by @​stasimus.

🚀 updates

• Scala 3.9 REPL support by @​Gedochao in #​9564
• IO.jarParallel and IO.zipParallel by @​hoangmaihuy in sbt/io#540

🐛 bug fixes

• fix: Avoid rewriting unchanged plugin descriptors by @​unkarjedy in #​9613
• fix: Fixes -V parsing in sbt runners by @​anatoliykmetyuk in #​9626

behind the scenes

• ci: Remove cla-checker v1 by @​eed3si9n in #​9572
• Update sbtn to 2.0.0-8753a981 by @​eed3si9n in #​9635
• Bump IO to 1.13.0 by @​eed3si9n in #​9648

new contributors

• @​Gedochao made their first contribution in #​9564

Full Changelog: sbt/sbt@v1.12.15...v1.13.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.