Scala 3.8.4 ships fixes from a security audit conducted with the Open Source Technology Improvement Fund and Quarkslab, including hardened TASTy parsing against maliciously crafted files, a fix for a stored XSS vulnerability in Scaladoc, improved error handling in scala.sys.process.Parser.tokenize, and a corrected JAR-walking logic in TastyPrinter. The release also adds :help support for all compiler settings (not just a fixed subset) usable both from the command line and the REPL via :settings, and bundles Scala CLI 1.14.0, upgraded from 1.11.x, which brings support for .test.java files, an auto-IDE-setup toggle, Scala.js 1.21.0 support, deprecation of the Ammonite REPL, and GraalVM native-image packaging options.
Table of contents
Security audit fixes:help syntax for all compiler settings ( #26052 )Upgrade to Scala CLI 1.14.0Questions this post answers
What security fixes are included in Scala 3.8.4?
Scala 3.8.4 fixes several issues found during a security audit with the Open Source Technology Improvement Fund and Quarkslab. It hardens TASTy parsing to prevent infinite loops on maliciously crafted files, fixes a stored XSS vulnerability in Scaladoc, improves error handling in scala.sys.process.Parser.tokenize, and corrects TastyPrinter's JAR-walking logic to include subdirectories. Teams patching Scala toolchains for security issues can track releases like this one on daily.dev.
How do I see documentation for a specific Scala compiler flag?
Append :help to any compiler setting to view its documentation, a feature introduced in Scala 3.8.4 that now works for all compiler options rather than a fixed subset. From the command line, run something like `scala test.scala -Xkind-projector:help`, or in the REPL use `:settings -Wunused:help` to get the same output. Developers exploring compiler flags can follow Scala tooling updates like this on daily.dev.
What version of Scala CLI is bundled with Scala 3.8.4 and what changed?
Scala 3.8.4 bundles Scala CLI 1.14.0, upgraded from 1.11.x through 1.12.5 and 1.13.0. Notable additions include experimental --cross support for run/package/doc, Scala.js 1.21.0 support, deprecation of the Ammonite REPL, a java-test-runner for pure Java tests, GraalVM native-image packaging options, support for .test.java files, and a toggle to disable auto-IDE-setup. Anyone tracking Scala CLI changes before upgrading can follow tooling updates like this on daily.dev.