sbt

The prerelease label adds some version risk, and most workflow actions are unpinned. Signed Maven provenance, release notes, tests, and an organization-backed project improve confidence.

Latest 2.1.0-M3org.scala-sbt

Maven

88%

Total Score

Maintainer Stability

100

Dependencies

100

Maturity

Supply Chain

Attestations

100

Are you affected? Scan for Free

Health Score Breakdown

Security policy

The repository has no published security policy, leaving reporting and response expectations less transparent. This is a moderate documentation gap rather than evidence of abandonment.

Version stability

This release is a prerelease, so it may change before final stabilization. The recent prerelease share is only 25%, which limits but does not remove that concern.

Workflow audit

All eight workflows were analyzed with no high- or medium-severity findings or untrusted sinks, but 25 of 26 action references are unpinned and two workflows grant top-level write access. These are workflow hygiene concerns, not a severe risk on their own.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-310773 sbt is vulnerable to Improper Authorization in versions 1.1.0 - 1.12.14 and 2.0.0 - 2.0.5.	1.1.0 - 1.12.142.0.0 - 2.0.5	Critical
CVE-2026-32948 org.scala-sbt:sbt is vulnerable to Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in versions 0.9.5 - 1.12.7.	0.9.5 - 1.12.7	Medium
CVE-2023-46122 org.scala-sbt:sbt is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in versions 0.3.4 - 1.9.7.	0.3.4 - 1.9.7	Low