Play Framework Versions Save

The Community Maintained High Velocity Web Framework For Java and Scala.

2.8.18

1 year ago

The Play Team is happy to announce the release of Play 2.8.18.

:green_book: What is new?

This release includes a fix for #10590 to avoid StackOverflowErrors when sending multipart/form-data requests with many fields as payload. We recommend upgrading as soon as possible.

Following pull requests got merged for this release:

  • #11491 [2.8.x] Upgrade Akka, Netty, Spring, Joda-Time by @mkurz
  • #11360 To refactor BodyPartParser of Multipart in order to avoid StackOverflowError easily by @yousuketto
  • #11465 [2.8.x] Update MIME types (backport #11406) by @PromanSEW
  • #11464 [2.8.x] Upgrade netty-reactive-streams by @mkurz
  • #11459 [2.8.x] Latest scala sbt versions by @mkurz

For more details see the full list of changes and the 2.8.18 milestone.

:heart: Thanks to our premium sponsors!

If you find this OSS project useful for work, please consider asking your company to support it by becoming a sponsor. You can also individually sponsor the project by becoming a backer.

:bow: Thanks to our contributors

Finally, thanks to the community for their help with detailed bug reports, discussions about new features and pull request reviews. This project is only possible due to the help we had from amazing contributors. Special thanks to all code contributors who helped with this particular release (they are listed below)!

2.8.17

1 year ago

The Play Team is happy to announce the release of Play 2.8.17.

:green_book: What is new?

Following pull requests got merged for this release:

  • #11430 [2.8.x] Update Evolutions.scala (backport #11345) by @BlankFX
  • #11419 SLF4J 2 compatibility: avoid direct usage of StaticLoggerBinder by @jfsoul
  • #11367 link to ScalaCompileTimeDI doc from the DI section of the ScalaWS help by @ianknowles
  • #11333 [2.8.x] Update branch in message (RedirectHttpsFilter) (backport #11332) by @PromanSEW
  • #11320 [2.8.x] Remove 3rd party tools page by @felipebonezi
  • #11309 Update ImplementingHelloWorld.md by @ysedira

For more details see the full list of changes and the 2.8.17 milestone.

:heart: Thanks to our premium sponsors!

If you find this OSS project useful for work, please consider asking your company to support it by becoming a sponsor. You can also individually sponsor the project by becoming a backer.

:bow: Thanks to our contributors

Finally, thanks to the community for their help with detailed bug reports, discussions about new features and pull request reviews. This project is only possible due to the help we had from amazing contributors. Special thanks to all code contributors who helped with this particular release (they are listed below)!

2.8.16

1 year ago

The Play Team is happy to announce the release of Play 2.8.16.

:green_book: What is new?

The following are the relevant changes of this bugfix release:

  • Patched a moderate CVE to prevent a denial of service when binding forms to deeply-nested JSON objects. #11301
  • Patched a minor CVE that can sometimes result in developer mode errors showing in production mode. #11305
  • Adds support for the 'bundleresource' protocol, when checking URLs. #11108

The following pull requests got merged for this release:

  • #11305 [2.8.x] Introduce DevHttpErrorHandler by @BillyAutrey, @mkurz
  • #11301 [2.8.x] add depth limit for JSON form binding by @gmethvin, @mkurz
  • #11291 [2.8.x] GHA: Also release on publish event + secrets inherit by @mkurz
  • #11289 [2.8.x] Refactor badges by @mkurz
  • #11269 [2.8.x] Bump version of sharable workflows to v2 by @ihostage
  • #11252 [2.8.x] Adding support for checking URL with protocol='bundleresource' existence by @asaelitz, @mkurz
  • #11265 [2.8.x] Remove play-enhancer from docs, project is dead by @PromanSEW
  • #11262 [2.8.x] Switch to GitHub actions by @mkurz
  • #11228 [2.8.x] Make scripts more userfriendly if running outside of CI by @mkurz

For more details see the full list of changes and the 2.8.16 milestone.

:heart: Thanks to our premium sponsors!

If you find this OSS project useful for work, please consider asking your company to support it by becoming a sponsor. You can also individually sponsor the project by becoming a backer.

:bow: Thanks to our contributors

Finally, thanks to the community for their help with detailed bug reports, discussions about new features and pull request reviews. This project is only possible due to the help we had from amazing contributors. Special thanks to all code contributors who helped with this particular release (they are listed below)!

Something you want to talk about for this release? Join the discussion

2.8.15

2 years ago

The Play Team is happy to announce the release of Play 2.8.15.

:green_book: What is new?

The following are the relevant changes of this bugfix release.

:lady_beetle: Fixed Spring4Shell (CVE-2022-22965)

This RCE vulnerability might affect Play Java users that deploy their applications as a war file (e.g. in Tomcat). More details can be found here: A note on Spring4Shell for Play Java users

:lady_beetle: About CVE-2020-36518 in Jackson and Play 2.8.x

Please see https://github.com/playframework/playframework/discussions/11222

:coffee: Experimental support for Java 17

You should now be able to run your Play applications with Java 17, but to do so, you have to make some adjustments.

:warning: Even though people report running their Play 2.8.15+ apps on Java 17 without issues, support for Java 17 is experimental. :warning: :warning: Make sure to test your application thoroughly before putting it into production. :warning:

  // In your build.sbt add:
  libraryDependencies ++= Seq(
    "com.google.inject"            % "guice"                % "5.1.0",
    "com.google.inject.extensions" % "guice-assistedinject" % "5.1.0"
  )
  • If you are using the Java routing DSL you have to upgrade typetools (see #10055 and #10814):
  // In your build.sbt add:
  libraryDependencies += "net.jodah" % "typetools" % "0.6.3"
  • Avoid using jnotify for the FileWatchService (like in this removed test)
  • To be able to run tests using OneServerPerTestWithComponents or GuiceOneServerPerTest (see #11209):
  // In your build.sbt add:
  Test / javaOptions ++= Seq(
    "--add-exports=java.base/sun.security.x509=ALL-UNNAMED",
    "--add-opens=java.base/sun.security.ssl=ALL-UNNAMED"
  )
  // Test / fork := true // This is the default anyway, just a reminder in case you changed it to false before

If you run into any other issues please let us know by opening a bug report, thanks!

:book: Following pull requests got merged for this release

  • #11214 [2.8.x] Upgrade Spring to fix Spring4Shell vulnerability by @mkurz
  • #11215 [2.8.x] Adjust welcome message for experimental Java 17 support by @mkurz
  • #11210 Remove -XX:MaxPermSize, breaks on Java 17 by @mkurz
  • #11207 [2.8.x] Update dependencies before next 2.8.x release by @mkurz
  • #11206 [2.8.x] Partial support for Java17 by @mkurz
  • #11205 [2.8.x] Fix docs: Passing request to WebSocket action not supported (backport #11172) by @mkurz
  • #11202 [2.8.x] Reverts #11109 (downgrade ssl-config back to 0.4.x) by @mkurz
  • #11200 typing error by @Sanabria13
  • #11195 Doc fix: Body needs to be redirected with POST by @mkurz
  • #11175 Update jquery dependency to 3.6.0 version by @morellik
  • #11178 [2.8.x] Make the "please donate" message more friendly (backport #11177) by @jxtps
  • #11129 Remove old or abandoned 3rd party play modules from module directory by @Max-AR
  • #11149 [2.8.x] Update release drafter workflow by @mkurz
  • #11146 [2.8.x] Rename master branch to main by @mkurz
  • #11140 [2.8.x] Cleanup .github folder by @mkurz
  • #11130 [2.8.x] Remove iteratees docs by @Max-AR
  • #11117 [2.8.x] Renamed Boxfuse to CloudCaptain by @axelfontaine
  • #11119 [2.8.x] change uri parse path error from warn to debug (backport #10151) by @fusuiyi123
  • #11116 [2.8.x] Make sure to append -SNAPSHOT for sonatype by @mkurz
  • #11109 [2.8.x] Use ssl-config to 0.6.0 by @mkurz

For more details see the full list of changes and the 2.8.15 milestone.

:heart: Thanks to our premium sponsors!

If you find this OSS project useful for work, please consider asking your company to support it by becoming a sponsor. You can also individually sponsor the project by becoming a backer.

:bow: Thanks to our contributors

Finally, thanks to the community for their help with detailed bug reports, discussions about new features and pull request reviews. This project is only possible due to the help we had from amazing contributors. Special thanks to all code contributors who helped with this particular release (they are listed below)!

2.8.13

2 years ago

The Play Team is happy to announce the release of Play 2.8.13.

:green_book: What is new?

Following pull requests got merged for this release:

  • Dev server should not exit when it receives EOF (-1) #11088 by @mkurz
  • play-ws 2.1.7 #11083 by @mkurz
  • Bump versions (backport #11050) #11076 by @scala-steward and @mkurz
  • [2.8.x] Add onLoadMessage #11071 by @mkurz
  • Shutdown dev server when pressing CTRL+C during run #11064 by @mkurz
  • ConsoleReader should be blocking in sbt 1.4+ since System.in already is non-blocking #11061 by @mkurz
  • Updating log4j to 2.17 in docs (backport #11060) #11062 by @BillyAutrey
  • Updating log4j ref in docs to 2.16.0 (backport #11053) #11054 by @BillyAutrey
  • Show latest version of java supported in 2.8 in Requirements.md #11055 by @syntapy
  • Upgraded version of log4j used in docs to 2.15.0 (backport #11051) #11052 by @jroper

For more details see the full list of changes and the 2.8.13 milestone.

:heart: Thanks to our premium sponsors!

If you find Play useful for work, please consider asking your company to support this Open Source project by becoming a sponsor. You can also individually sponsor the project by becoming a backer.

:bow: Thanks to our contributors

Finally, thanks to the community for their help with detailed bug reports, discussion about new features, and pull requests review. Play is only possible due to the help we had from amazing contributors. Special thanks to all code contributors who helped with this particular release (they are listed below)!

2.8.11

2 years ago

The Play Team is happy to announce the releases of Play 2.8.11.

This release brings in a new version of Akka Http including security updates.

:green_book: What is new?

Following pull requests got merged for this release:

For more details see the full list of changes and the 2.8.11 milestone.

:bow: Credits

Finally, thanks to the community for their help with detailed bug reports, discussion about new features, and pull requests review. Play is only possible due to the help we had from amazing contributors.

If you find Play useful for work, please consider to support this Open Source project by becoming a backer or premium sponsor. You can donate to our Open Collective here.

Special thanks to the following contributors who helped with this release:

@FuriousTurtle, @PromanSEW, @TrevorNathan, @arid-mangoss, @ennru, @gmethvin, @ignasi35, @johnduffell, @kaseken, @mergify, @mergify[bot], @mkurz, @octonato, @rstento and @scala-steward

Full Changelog: https://github.com/playframework/playframework/compare/2.8.8...2.8.11

2.8.8

3 years ago

:mega: Play 2.8.8 Released

The Play Team is happy to announce the releases of Play 2.8.8.

:green_book: What is new?

The following are the relevant changes of this bugfix release:

Following pull requests got merged for this release:

  • Bump akka 2.6.14 #10806 by @ignasi35
  • Sunset bintray 2.1.x #10804 by @ignasi35
  • Fix: Playdevmode compiles twice (requires sbt 1.4+) #10373
  • Akka-Http-Server: allow Headers.remove() to remove Content-Type and Content-Length (bp #10797) #10801 by @mergify
  • Run scripted tests with sbt 1.5.0 (bp #10796) #10799 by @mergify
  • Update netty-transport-native-epoll to 4.1.63.Final (bp #10795) #10798 by @mergify
  • Bump Jackson to 2.11.x (bp #10781) #10788 by @mergify
  • revert changes to playCommonClassloaderTask since we are using scala 2.12.13 (bp #10782) #10783 by @mergify
  • Make public DatabaseEvolutions.databaseEvolutions() (bp #10754) #10779 by @mergify
  • [2.8.x] Add release-drafter workflow for 2.8.x branch + docs update #10775 by @mkurz
  • [2.8.x] Upgrade dependencies before releasing Play 2.8.8 #10767 by @mkurz
  • Update play-file-watch to 1.1.16 (bp #10759) #10761 by @mergify
  • [2.8.x] Run scripted tests on sbt 1.4.x + refactoring #10723 by @mkurz
  • fix Int overflow in BodyParsers.anyContent(maxLength: Option[Long]) (bp #10741) #10753 by @mergify
  • Routes compiler: Remove generation date, keep the source relative (bp #10707) #10735 by @mergify
  • Update play-file-watch to 1.1.15 (bp #10736) #10737 by @mergify
  • [2.8.x] Support sbt 1.4 virtual files for compilation and config errors #10712 by @mkurz
  • gitignore .bsp folder (Build Server Protocol / sbt 1.4) (bp #10631) #10722 by @mergify
  • Scala 2.12.13 and 2.13.5 (bp #10718) #10721 by @mergify
  • Upgrade akka and akka-http (bp #10717) #10719 by @mergify
  • Catch Throwable instead of NonFatal when starting prod server (bp #10690) #10701 by @mergify
  • QueryStringBindable.unbind(): Do-do-do URLEncode for all queryString keys! (bp #10370) #10694 by @mergify
  • Add type annotation for Optional.empty (bp #10442) #10688 by @mergify
  • Java forms should handle "foo[].bar" fields when using subforms (index missing) (bp #10680) #10682 by @mergify
  • Java forms: Prefix a ValidationError's key with parent form field key (bp #10666) #10678 by @mergify
  • [2.8.x] Support sbt 1.4 virtual files when displaying error source #10649 by @mkurz
  • Add empty parentheses () to generated reverse route method depending on routes file (bp #10671) #10673 by @mergify
  • Don't reload/(re-)compile or even start an app when shutting down in DEV mode (bp #10661) #10669 by @mergify
  • In DEV mode, only set the editor in the error handler if config is valid (bp #10662) #10663 by @mergify
  • Fix classloader memory leak, due to ClassTag (bp #10500) #10658 by @mergify
  • build: Switch to using javafmtCheckAll (new version) (bp #9960) #10652 by @mergify
  • fix DefaultTemporaryFileCreator leak (bp #10498) #10653 by @mergify
  • Fix build cache issues (bp #10014) #10651 by @mergify
  • Close digest-files in DefaultAssetsMetadata (bp #10639) #10646 by @mergify
  • Caffeine Cache Manager - Expose cache names (bp #10637) #10645 by @mergify
  • Correct the HostMatcher logic to get host and port (bp #10456) #10632 by @mergify
  • shutdown-happy-path: make test more reliable (bp #10598) #10600 by @mergify

For more details see the full list of changes and the 2.8.8 milestone.

:bow: Credits

Special thanks to @mkurz for his continued contributions and insight to push Play forward, and, in this release in particular, for the extra work to make the release come true.

Also, thanks to the community for their help with detailed bug reports, discussion about new features, and pull requests review. Play is only possible due to the help we had from amazing contributors.

Thanks to Lightbend for their continued sponsorship of the Play core team's efforts. Lightbend offers commercial support for Play.

Special thanks to the following contributors who helped with this release:

@Captain1653, @asazernik, @benwaffle, @dwijnand, @eatkins, @gokhanoner, @helllamer, @ignasi35, @jtjeferreira, @marcospereira, @mkurz, @octonato, @pazvanti, @pschichtel, @raboof and @xuwei-k

2.7.9

3 years ago

:mega: Play 2.7.9 Released

The Play Team is happy to announce the releases of Play 2.8.7 and Play 2.7.9.

As we found a regression just after building the 2.8.6 and 2.7.8 releases, we followed up on those without announcing them.

:green_book: What is new?

The following are the relevant changes of this bugfix release:

  • Let user overwrite limit memory size on form binding #10543
  • The Play Runner now works on Mac OS Big Sur #10372
  • We publish a Maven BOM pom.xml for Play 2.8 #10549

For more details see the full list of changes and the 2.7.8 and 2.7.9 milestones.

Migration

To make the form binding size limit configurable, some sources may need adaptation to make the FormBinding implicits available (see Parser maxMemoryBuffer limits).

:bow: Credits

Finally, thanks to the community for their help with detailed bug reports, discussion about new features, and pull requests review. Play is only possible due to the help we had from amazing contributors.

Thanks to Lightbend for their continued sponsorship of the Play core team's efforts. Lightbend offers commercial support for Play.

2.8.7

3 years ago

:mega: Play 2.8.7 Released

The Play Team is happy to announce the releases of Play 2.8.7 and Play 2.7.9.

As we found a regression just after building the 2.8.6 and 2.7.8 releases, we followed up on those without announcing them.

:green_book: What is new?

The following are the relevant changes of this bugfix release:

  • Let user overwrite limit memory size on form binding #10543
  • The Play Runner now works on Mac OS Big Sur #10372
  • We publish a Maven BOM pom.xml for Play 2.8 #10549

For more details see the full list of changes and the 2.8.6 and 2.8.7 milestones.

Migration

To make the form binding size limit configurable, some sources may need adaptation to make the FormBinding implicits available (see Parser maxMemoryBuffer limits).

:bow: Credits

Finally, thanks to the community for their help with detailed bug reports, discussion about new features, and pull requests review. Play is only possible due to the help we had from amazing contributors.

Thanks to Lightbend for their continued sponsorship of the Play core team's efforts. Lightbend offers commercial support for Play.

2.8.5

3 years ago

:mega: Play 2.8.5 Released

The Play Team is proud to announce the release of Play 2.8.5.

:green_book: What is new?

The following is the main change of this bugfix release:

Other improvements in this release:

For more details see the full list of changes and the 2.8.5 milestone.

:bow: Credits

Finally, thanks to the community for their help with detailed bug reports, discussion about new features, and pull requests review. Play 2.8.5 is only possible due to the help we had from amazing contributors.

Thanks to Lightbend for their continued sponsorship of the Play core team's efforts. Lightbend offers commercial support for Play.