We are pleased to announce the release of Play 3.0.10! 🎉

📗 About this Release

This release fixes several bugs and addresses reported security vulnerabilities (CVEs) and - as always - updates dependencies. We strongly recommend upgrading at your earliest convenience.

If you're considering upgrading to Play 3.0, please check the Play 3.0 release announcement for highlights and further details on how to migrate. Many projects have already smoothly upgraded to Play 3.0.

Noteworthy Pull Request

• playframework/play-json#1228 [3.0.x] Avoid running out of memory when parsing heavily nested arrays or objects by @mkurz
  We now limit the maximum allowed nesting depth of JSON structures (arrays, objects, or a mix of both) to 1000.
  This limit can be adjusted using the system property play.json.parser.maxNestingDepth.
  We assume a depth of 1000 should be more than sufficient for virtually all real-world use cases.
  This change helps prevent both potential OutOfMemoryErrors and StackOverflowErrors.
  The latter, however, is not a concern for Play JSON, since it already uses a @tailrec-optimized parsing method.
  As a result, Play JSON is not affected by GHSA-h46c-h94j-95f3, which specifically addresses StackOverflowError risks.
  This improvement is simply an additional safety measure.
• #13684 [3.0.x] Bump to lz4-java 1.10.1 to fix CVE-2025-66566 and CVE‐2025‐12183 by @mkurz
• #13706 [3.0.x] Netty 4.1.130.Final to fix CVE-2025-67735 by @mkurz
• Upgrade ch.qos.logback:logback-core to fix CVE-2025-11226 (see "Patch updates" below)

Following pull requests got merged for this release:

• #13717 [3.0.x] Patch updates by @mkurz
• #13712 [3.0.x] Patch updates by @scala-steward
• #13706 [3.0.x] Netty 4.1.130.Final by @mkurz
• #13705 [3.0.x] hibernate-core 6.6.39.Final (was 6.6.38.Final) by @scala-steward
• #13693 [3.0.x] Patch updates by @mkurz
• #13691 [3.0.x] netty-codec-http, netty-handler, ... 4.1.129.Final (was 4.1.128.Final) by @mkurz
• #13684 [3.0.x] Bump to lz4-java 1.10.1 to fix CVE-2025-66566 by @mkurz
• #13682 [3.0.x] lz4-java 1.8.1 by @mkurz
• #13679 [3.0.x] hibernate-core 6.6.38.Final (was 6.6.37.Final) by @scala-steward
• #13674 [3.0.x] Patch updates by @scala-steward
• #13670 [3.0.x] Bump actions/checkout from 5 to 6 by @dependabot[bot]
• #13668 [3.0.x] hibernate-core 6.6.37.Final (was 6.6.36.Final) by @scala-steward
• #13662 [3.0.x] hibernate-core 6.6.36.Final (was 6.6.35.Final) by @scala-steward
• #13660 [3.0.x] hibernate-core 6.6.35.Final (was 6.6.34.Final) by @scala-steward
• #13658 [3.0.x] Patch updates by @scala-steward
• #13637 [3.0.x] commons-io 2.21.0 (was 2.20.0) by @scala-steward
• #13632 [3.0.x] Patch updates by @scala-steward
• #13625 [3.0.x] hibernate-core 6.6.34.Final (was 6.6.33.Final) by @scala-steward
• #13611 [3.0.x] Patch updates by @mkurz
• #13613 [3.0.x] Pin ssl-config (backport #13612) by @mkurz
• #13605 [3.0.x] scalafmt-core 3.10.0 (was 3.9.10) by @scala-steward
• #13603 [3.0.x] hibernate-core 6.6.33.Final (was 6.6.31.Final) by @scala-steward
• #13607 [3.0.x] netty-codec-http, netty-handler, ... 4.1.128.Final (was 4.1.127.Final) by @scala-steward
• #13597 [3.0.x] Patch updates by @scala-steward
• #13594 [3.0.x] hibernate-core 6.6.31.Final (was 6.6.30.Final) by @scala-steward
• #13588 [3.0.x] Patch updates by @scala-steward
• #13586 [3.0.x] sbt-native-packager 1.11.4 (backport #13584) by @mkurz
• #13570 [3.0.x] sbt-jmh 0.4.8 (was 0.4.7) by @scala-steward
• #13569 [3.0.x] hibernate-core 6.6.30.Final (was 6.6.29.Final) by @scala-steward
• #13561 [3.0.x] h2 2.4.240 (was 2.3.232) by @scala-steward
• #13551 [3.0.x] Patch updates by @scala-steward
• #13545 [3.0.x] hibernate-core 6.6.29.Final (was 6.6.28.Final) by @scala-steward
• #13541 [3.0.x] sbt-header 5.11.0 (was 5.10.0) by @scala-steward

For more details see the full list of changes and the 3.0.10 milestone.

❤️ Thanks to our premium sponsors!

If you find this OSS project useful for work, please consider asking your company to support it by becoming a sponsor.
You can also individually sponsor the project by becoming a backer.

🙇 Thanks to our contributors

Finally, thanks to the community for their help with detailed bug reports, discussions about new features and pull request reviews. This project is only possible due to the help we had from amazing contributors.
Special thanks to all code contributors who helped with this particular release (they are listed below)!

We are pleased to announce the release of Play 2.9.10! 🎉

📗 About this Release

This release fixes several bugs and addresses reported security vulnerabilities (CVEs) and - as always - updates dependencies. We strongly recommend upgrading at your earliest convenience.

If you're considering upgrading to Play 2.9, please check the Play 2.9 release announcement for highlights and further details on how to migrate. Many projects have already smoothly upgraded to Play 2.9.

Noteworthy Pull Request

• playframework/play-json#1226 Avoid running out of memory when parsing heavily nested arrays or objects by @mkurz
  We now limit the maximum allowed nesting depth of JSON structures (arrays, objects, or a mix of both) to 1000.
  This limit can be adjusted using the system property play.json.parser.maxNestingDepth.
  We assume a depth of 1000 should be more than sufficient for virtually all real-world use cases.
  This change helps prevent both potential OutOfMemoryErrors and StackOverflowErrors.
  The latter, however, is not a concern for Play JSON, since it already uses a @tailrec-optimized parsing method.
  As a result, Play JSON is not affected by GHSA-h46c-h94j-95f3, which specifically addresses StackOverflowError risks.
  This improvement is simply an additional safety measure.
• #13685 [2.9.x] Bump to lz4-java 1.10.1 to fix CVE-2025-66566 and CVE‐2025‐12183 by @mkurz
• #13707 [2.9.x] Netty 4.1.130.Final (backport #13706) to fix CVE-2025-67735 by @mkurz
• Upgrade ch.qos.logback:logback-core to fix CVE-2025-11226 (see "Patch updates" below)

Following pull requests got merged for this release:

• #13715 [2.9.x] Patch updates by @mkurz
• #13711 [2.9.x] Patch updates by @scala-steward
• #13707 [2.9.x] Netty 4.1.130.Final (backport #13706) by @mkurz
• #13704 [2.9.x] hibernate-core 6.6.39.Final (was 6.6.38.Final) by @scala-steward
• #13690 [2.9.x] Patch updates by @mkurz
• #13688 [2.9.x] netty-codec-http, netty-handler, ... 4.1.129.Final (was 4.1.128.Final) by @mkurz
• #13685 [2.9.x] Bump to lz4-java 1.10.1 to fix CVE-2025-66566 by @mkurz
• #13683 [2.9.x] lz4-java 1.8.1 (backport #13682) by @mkurz
• #13678 [2.9.x] hibernate-core 6.6.38.Final (was 6.6.37.Final) by @scala-steward
• #13673 [2.9.x] Patch updates by @scala-steward
• #13669 [2.9.x] Bump actions/checkout from 5 to 6 by @dependabot[bot]
• #13667 [2.9.x] hibernate-core 6.6.37.Final (was 6.6.36.Final) by @scala-steward
• #13661 [2.9.x] hibernate-core 6.6.36.Final (was 6.6.35.Final) by @scala-steward
• #13659 [2.9.x] hibernate-core 6.6.35.Final (was 6.6.34.Final) by @scala-steward
• #13656 [2.9.x] Patch updates by @scala-steward
• #13636 [2.9.x] commons-io 2.21.0 (was 2.20.0) by @scala-steward
• #13631 [2.9.x] Patch updates by @scala-steward
• #13624 [2.9.x] hibernate-core 6.6.34.Final (was 6.6.33.Final) by @scala-steward
• #13609 [2.9.x] Patch updates by @mkurz
• #13612 [2.9.x] Pin ssl-config by @mkurz
• #13604 [2.9.x] scalafmt-core 3.10.0 (was 3.9.10) by @scala-steward
• #13602 [2.9.x] hibernate-core 6.6.33.Final (was 6.6.31.Final) by @scala-steward
• #13606 [2.9.x] netty-codec-http, netty-handler, ... 4.1.128.Final (was 4.1.127.Final) by @scala-steward
• #13596 [2.9.x] Patch updates by @scala-steward
• #13593 [2.9.x] hibernate-core 6.6.31.Final (was 6.6.30.Final) by @scala-steward
• #13587 [2.9.x] Patch updates by @scala-steward
• #13585 [2.9.x] sbt-native-packager 1.11.4 (backport #13584) by @mkurz
• #13568 [2.9.x] sbt-jmh 0.4.8 (was 0.4.7) by @scala-steward
• #13567 [2.9.x] hibernate-core 6.6.30.Final (was 6.6.29.Final) by @scala-steward
• #13560 [2.9.x] h2 2.4.240 (was 2.3.232) by @scala-steward
• #13550 [2.9.x] Patch updates by @scala-steward
• #13544 [2.9.x] hibernate-core 6.6.29.Final (was 6.6.28.Final) by @scala-steward
• #13540 [2.9.x] sbt-header 5.11.0 (was 5.10.0) by @scala-steward

For more details see the full list of changes and the 2.9.10 milestone.

❤️ Thanks to our premium sponsors!

If you find this OSS project useful for work, please consider asking your company to support it by becoming a sponsor.
You can also individually sponsor the project by becoming a backer.

🙇 Thanks to our contributors

Finally, thanks to the community for their help with detailed bug reports, discussions about new features and pull request reviews. This project is only possible due to the help we had from amazing contributors.
Special thanks to all code contributors who helped with this particular release (they are listed below)!

The Play Team is happy to announce the release of Play 3.0.9! 🎉

📗 About this Release

This patch release upgrades dependencies, fixes minor bugs, comes with support for Java 25 and improves compatibility with Scala 3. We recommend upgrading as soon as possible.

If you're considering upgrading to Play 3.0, please check the Play 3.0 release announcement for highlights and further details on how to migrate. Many projects have already smoothly upgraded to Play 3.0.

Official support for Java 25

Starting with this release, Play officially supports Java 25. Since all tests passed when running on the latest Java 25 release candidate, we are comfortable declaring Java 25 officially supported by Play.

Noteworthy Pull Requests

• #13499 [3.0.x] Declare Java 25 LTS officially supported by @mkurz
• #13462 [3.0.x] fix routes cache directory (backport #13443) by @xuwei-k
• #13423 [3.0.x] Generate and set the request-id as early as possible (backport #13409) by @mkurz
• #13419 [3.0.x] A call to onClientError from the server backend was missing the HttpErrorInfo attr (backport #13416) by @mkurz
• #13415 [3.0.x] Make sure Java's Session and Flash always exists even if empty req attrs (backport #13413) by @mkurz
• #13407 [3.0.x] Make sure Cookies, Session, Flash always exists even if empty by @mkurz
• #13520 [3.0.x] Netty 4.1.127.Final (backport #13517) by @mkurz

Full Changelog

Following pull requests got merged for this release:

• #13535 [3.0.x] Nicer warning for unsupported Java versions by @mkurz
• #13531 [3.0.x] Lightbend config 1.4.5 by @mkurz
• #13529 [3.0.x] play-ws 3.0.8 by @mkurz
• #13527 [3.0.x] netty-reactive-streams 3.0.5 by @mkurz
• #13520 [3.0.x] Netty 4.1.127.Final (backport #13517) by @mkurz
• #13516 [3.0.x] Patch updates by @scala-steward
• #13505 [3.0.x] netty-codec-http, netty-handler, ... 4.1.126.Final (was 4.1.124.Final) by @scala-steward
• #13498 [3.0.x] sbt-pekko-version-check 0.0.8 (was 0.0.7) by @scala-steward
• #13499 [3.0.x] Declare Java 25 LTS officially supported by @mkurz
• #13493 [3.0.x] Upgrade byte-buddy for Java 25 support by @mkurz
• #13492 [3.0.x] hibernate-core 6.6.28.Final (was 6.6.27.Final) by @scala-steward
• #13488 [3.0.x] Fix deprecated notice in WSResponse#getBodyAsStream (backport #13484) by @Enet4
• #13486 [3.0.x] Patch updates by @scala-steward
• #13482 [3.0.x] Patch updates by @scala-steward
• #13481 [3.0.x] hibernate-core 6.6.27.Final (was 6.6.26.Final) by @scala-steward
• #13464 [3.0.x] fix "match may not be exhaustive" warning (backport #13441) by @xuwei-k
• #13462 [3.0.x] fix routes cache directory (backport #13443) by @xuwei-k
• #13460 [3.0.x] Patch updates by @scala-steward
• #13444 [3.0.x] Bump actions/checkout from 4 to 5 by @dependabot[bot]
• #13451 [3.0.x] Patch updates by @scala-steward
• #13453 [3.0.x] netty-codec-http, netty-handler, ... 4.1.124.Final (was 4.1.123.Final) by @scala-steward
• #13455 [3.0.x] hibernate-core 6.6.26.Final (was 6.6.23.Final) by @scala-steward
• #13439 [3.0.x] Patch updates by @scala-steward
• #13434 [3.0.x] hibernate-core 6.6.23.Final (was 6.6.22.Final) by @scala-steward
• #13429 [3.0.x] hibernate-core 6.6.22.Final (was 6.6.21.Final) by @scala-steward
• #13427 [3.0.x] commons-io 2.20.0 (was 2.19.0) by @scala-steward
• #13425 [3.0.x] Test: Allow accessing empty cookies, session and flash from an error handler by @mkurz
• #13423 [3.0.x] Generate and set the request-id as early as possible (backport #13409) by @mkurz
• #13421 [3.0.x] netty-codec-http, netty-handler, ... 4.1.123.Final (was 4.1.122.Final) by @scala-steward
• #13419 [3.0.x] A call to onClientError from the server backend was missing the HttpErrorInfo attr (backport #13416) by @mkurz
• #13415 [3.0.x] Make sure Java's Session and Flash always exists even if empty req attrs (backport #13413) by @mkurz
• #13407 [3.0.x] Make sure Cookies, Session, Flash always exists even if empty by @mkurz
• #13405 [3.0.x] Patch updates by @scala-steward
• #13404 [3.0.x] hibernate-core 6.6.21.Final (was 6.6.20.Final) by @scala-steward
• #13400 [3.0.x] Patch updates by @scala-steward
• #13392 [3.0.x] Patch updates by @scala-steward
• #13391 [3.0.x] hibernate-core 6.6.20.Final (was 6.6.19.Final) by @scala-steward
• #13388 [3.0.x] Scala stewards should always updates, not just monthly (backport #13386) by @mkurz
• #13385 [3.0.x] Pin okhttp in scala steward (backport #13384) by @mkurz
• #13383 [3.0.x] Patch updates by @mkurz
• #13362 [3.0.x] oss.sonatype.org is dead (backport #13360) by @mkurz

For more details see the full list of changes and the 3.0.9 milestone.

❤️ Thanks to our premium sponsors!

If you find this OSS project useful for work, please consider asking your company to support it by becoming a sponsor.
You can also individually sponsor the project by becoming a backer.

🙇 Thanks to our contributors

Finally, thanks to the community for their help with detailed bug reports, discussions about new features and pull request reviews. This project is only possible due to the help we had from amazing contributors.
Special thanks to all code contributors who helped with this particular release (they are listed below)!

The Play Team is happy to announce the release of Play 2.9.9! 🎉

📗 About this Release

This patch release upgrades dependencies, fixes minor bugs, comes with support for Java 25 and improves compatibility with Scala 3. We recommend upgrading as soon as possible.

If you're considering upgrading to Play 2.9, please check the Play 2.9 release announcement for highlights and further details on how to migrate. Many projects have already smoothly upgraded to Play 2.9.

Official support for Java 25

Starting with this release, Play officially supports Java 25. Since all tests passed when running on the latest Java 25 release candidate, we are comfortable declaring Java 25 officially supported by Play.

Noteworthy Pull Requests

• #13500 [2.9.x] Declare Java 25 LTS officially supported (backport #13499) by @mkurz
• #13461 [2.9.x] fix routes cache directory (backport #13443) by @xuwei-k
• #13422 [2.9.x] Generate and set the request-id as early as possible (backport #13409) by @mkurz
• #13418 [2.9.x] A call to onClientError from the server backend was missing the HttpErrorInfo attr (backport #13416) by @mkurz
• #13414 [2.9.x] Make sure Java's Session and Flash always exists even if empty req attrs (backport #13413) by @mkurz
• #13411 [2.9.x] Make sure Cookies, Session, Flash always exists even if empty (backport #13407) by @mkurz
• #13517 [2.9.x] Netty 4.1.127.Final by @mkurz

Full Changelog

Following pull requests got merged for this release:

• #13536 [2.9.x] Nicer warning for unsupported Java versions by @mkurz
• #13530 [2.9.x] Lightbend config 1.4.5 by @mkurz
• #13528 [2.9.x] play-ws 2.2.12 by @mkurz
• #13526 [2.9.x] netty-reactive-streams 2.0.15 by @mkurz
• #13517 [2.9.x] Netty 4.1.127.Final by @mkurz
• #13515 [2.9.x] Patch updates by @scala-steward
• #13504 [2.9.x] netty-codec-http, netty-handler, ... 4.1.126.Final (was 4.1.124.Final) by @scala-steward
• #13500 [2.9.x] Declare Java 25 LTS officially supported (backport #13499) by @mkurz
• #13494 [2.9.x] Upgrade byte-buddy for Java 25 support (backport #13493) by @mkurz
• #13491 [2.9.x] hibernate-core 6.6.28.Final (was 6.6.27.Final) by @scala-steward
• #13487 [2.9.x] Fix deprecated notice in WSResponse#getBodyAsStream (backport #13484) by @Enet4
• #13485 [2.9.x] Patch updates by @scala-steward
• #13480 [2.9.x] Patch updates by @scala-steward
• #13479 [2.9.x] hibernate-core 6.6.27.Final (was 6.6.26.Final) by @scala-steward
• #13463 [2.9.x] fix "match may not be exhaustive" warning (backport #13441) by @xuwei-k
• #13461 [2.9.x] fix routes cache directory (backport #13443) by @xuwei-k
• #13459 [2.9.x] Patch updates by @scala-steward
• #13447 [2.9.x] Bump actions/checkout from 4 to 5 by @dependabot[bot]
• #13449 [2.9.x] Patch updates by @scala-steward
• #13452 [2.9.x] netty-codec-http, netty-handler, ... 4.1.124.Final (was 4.1.123.Final) by @scala-steward
• #13454 [2.9.x] hibernate-core 6.6.26.Final (was 6.6.23.Final) by @scala-steward
• #13438 [2.9.x] Patch updates by @scala-steward
• #13433 [2.9.x] hibernate-core 6.6.23.Final (was 6.6.22.Final) by @scala-steward
• #13428 [2.9.x] hibernate-core 6.6.22.Final (was 6.6.21.Final) by @scala-steward
• #13426 [2.9.x] commons-io 2.20.0 (was 2.19.0) by @scala-steward
• #13424 [2.9.x] Test: Allow accessing empty cookies, session and flash from an error handler by @mkurz
• #13422 [2.9.x] Generate and set the request-id as early as possible (backport #13409) by @mkurz
• #13420 [2.9.x] netty-codec-http, netty-handler, ... 4.1.123.Final (was 4.1.122.Final) by @scala-steward
• #13418 [2.9.x] A call to onClientError from the server backend was missing the HttpErrorInfo attr (backport #13416) by @mkurz
• #13414 [2.9.x] Make sure Java's Session and Flash always exists even if empty req attrs (backport #13413) by @mkurz
• #13411 [2.9.x] Make sure Cookies, Session, Flash always exists even if empty (backport #13407) by @mkurz
• #13403 [2.9.x] Patch updates by @scala-steward
• #13402 [2.9.x] hibernate-core 6.6.21.Final (was 6.6.20.Final) by @scala-steward
• #13399 [2.9.x] Patch updates by @scala-steward
• #13390 [2.9.x] Patch updates by @scala-steward
• #13389 [2.9.x] hibernate-core 6.6.20.Final (was 6.6.19.Final) by @scala-steward
• #13387 [2.9.x] Scala stewards should always updates, not just monthly (backport #13386) by @mkurz
• #13384 [2.9.x] Pin okhttp in scala steward by @mkurz
• #13381 [2.9.x] Patch updates by @mkurz
• #13361 [2.9.x] oss.sonatype.org is dead (backport #13360) by @mkurz

For more details see the full list of changes and the 2.9.9 milestone.

❤️ Thanks to our premium sponsors!

If you find this OSS project useful for work, please consider asking your company to support it by becoming a sponsor.
You can also individually sponsor the project by becoming a backer.

🙇 Thanks to our contributors

Finally, thanks to the community for their help with detailed bug reports, discussions about new features and pull request reviews. This project is only possible due to the help we had from amazing contributors.
Special thanks to all code contributors who helped with this particular release (they are listed below)!

The Play Team is happy to announce the release of Play 3.0.8! 🥳

📗 About this Release

This release fixes several bugs and a CVE, improves Scala 3 support, and - as always - updates dependencies. We strongly recommend upgrading at your earliest convenience.

If you're considering upgrading to Play 3.0, please check the Play 3.0 release announcement for highlights and further details on how to migrate. Many projects have already smoothly upgraded to Play 3.0.

sbt 1.9.0 or newer is now required

Because of recent changes in how artifacts are published to Maven Central, older sbt versions can no longer retrieve Play's sbt plugins published starting July 1, 2025. If you're still using an older sbt release, you'll need to upgrade to sbt 1.9.0 or newer to continue fetching Play artifacts from Maven Central. Play 3.0.8 and newer will not work with earlier sbt versions. To be fair, when releasing Play 3.0, we already announced 1.9.0 as the minimum required sbt version, even though older versions may still have worked until now.

Scala 3 improvements

• Twirl now supports using in it's templates, so you can define template parameters like:

  @(x: Int)(using y: Int)

  Thanks to @ajafri2001 for implementing this improvement 🙌:
  playframework/twirl#933 Prepend "using" at the callsite when definition site has implicit parameter

• When using Play JSON, the JSON field ordering is now correctly preserved when compiling with Scala 3 - implemented by @xuwei-k:
  playframework/play-json#1177 fix field ordering Scala 3 writes macro

Noteworthy Pull Requests

• #13297 [3.0.x] Upgrade commons-beanutils to fix CVE-2025-48734 by @mkurz
• #13328 [3.0.x] Fix iterator for Cookies created via play.api.test.Helpers.cookies (backport #13317) by @murosan
• #13282 [3.0.x] Fix ClassCastException when using @With Java annotation by @mkurz

Full Changelog

Following pull requests got merged for this release:

• #13355 [3.0.x] sbt 1.11.2 everywhere by @mkurz
• #13322 [3.0.x] sbt-ci-release 1.11.1 (was 1.9.3) by @scala-steward
• #13325 [3.0.x] sbt, sbt-dependency-tree, ... 1.11.2 (was 1.10.11) by @scala-steward
• #13353 [3.0.x] Upgrade play-json by @mkurz
• #13349 [3.0.x] Upgrade twirl by @mkurz
• #13343 [3.0.x] hibernate-core 6.6.19.Final (was 6.6.18.Final) by @mkurz
• #13345 [3.0.x] Patch updates by @mkurz
• #13346 [3.0.x] Fix groupid in scala steward conf by @mkurz
• #13329 [3.0.x] Pin caffeine by @mkurz
• #13328 [3.0.x] Fix iterator for Cookies created via play.api.test.Helpers.cookies (backport #13317) by @murosan
• #13326 [3.0.x] Patch updates by @scala-steward
• #13323 [3.0.x] netty-codec-http, netty-handler, ... 4.1.122.Final (was 4.1.121.Final) by @scala-steward
• #13324 [3.0.x] hibernate-core 6.6.18.Final (was 6.6.15.Final) by @scala-steward
• #13312 [3.0.x] Pin Hibernate ORM to 6.x by @mkurz
• #13297 [3.0.x] Upgrade commons-beanutils to fix CVE-2025-48734 by @mkurz
• #13292 [3.0.x] Patch updates by @scala-steward
• #13290 [3.0.x] hibernate-core 6.6.15.Final (was 6.6.13.Final) by @scala-steward
• #13289 [3.0.x] netty-codec-http, netty-handler, ... 4.1.121.Final (was 4.1.119.Final) by @scala-steward
• #13282 [3.0.x] Fix ClassCastException when using @With Java annotation by @mkurz
• #13278 [3.0.x] docs: add note about known bug with logger configuration (backport #13275) by @gaeljw
• #13251 [3.0.x] sbt-java-formatter 0.10.0 (was 0.8.0) by @scala-steward
• #13252 [3.0.x] commons-io 2.19.0 (was 2.18.0) by @scala-steward
• #13253 [3.0.x] hibernate-core 6.6.13.Final (was 6.6.11.Final) by @scala-steward
• #13254 [3.0.x] Patch updates by @scala-steward
• #13249 [3.0.x] Use ubuntu-24.04 GHA runner image (backport #13107) by @mkurz
• #13242 [3.0.x] Pin Netty to 4.1.x (backport #13241) by @mkurz
• #13216 [3.0.x] Patch updates by @scala-steward
• #13215 [3.0.x] hibernate-core 6.6.11.Final (was 6.6.10.Final) by @scala-steward
• #13205 [3.0.x] Fix Heroku deprecated toolbelt URL on ProductionHeroku.md by @bidego

For more details see the full list of changes and the 3.0.8 milestone.

❤️ Thanks to our premium sponsors!

If you find this OSS project useful for work, please consider asking your company to support it by becoming a sponsor.
You can also individually sponsor the project by becoming a backer.

🙇 Thanks to our contributors

Finally, thanks to the community for their help with detailed bug reports, discussions about new features and pull request reviews. This project is only possible due to the help we had from amazing contributors.
Special thanks to all code contributors who helped with this particular release (they are listed below)!

The Play Team is happy to announce the release of Play 2.9.8! 🥳

📗 About this Release

This release fixes several bugs and a CVE, improves Scala 3 support, and - as always - updates dependencies. We strongly recommend upgrading at your earliest convenience.

If you're considering upgrading to Play 2.9, please check the Play 2.9 release announcement for highlights and further details on how to migrate. Many projects have already smoothly upgraded to Play 2.9.

sbt 1.9.0 or newer is now required

Because of recent changes in how artifacts are published to Maven Central, older sbt versions can no longer retrieve Play's sbt plugins published starting July 1, 2025. If you're still using an older sbt release, you'll need to upgrade to sbt 1.9.0 or newer to continue fetching Play artifacts from Maven Central. Play 2.9.8 and newer will not work with earlier sbt versions. To be fair, when releasing Play 2.9, we already announced 1.9.0 as the minimum required sbt version, even though older versions may still have worked until now.

Scala 3 improvements

• Twirl now supports using in it's templates, so you can define template parameters like:

  @(x: Int)(using y: Int)

  Thanks to @ajafri2001 for implementing this improvement 🙌:
  playframework/twirl#933 Prepend "using" at the callsite when definition site has implicit parameter

• When using Play JSON, the JSON field ordering is now correctly preserved when compiling with Scala 3 - implemented by @xuwei-k:
  playframework/play-json#1177 fix field ordering Scala 3 writes macro

Noteworthy Pull Requests

• #13299 [2.9.x] Upgrade commons-beanutils to fix CVE-2025-48734 (backport #13297) by @mkurz
• #13327 [2.9.x] Fix iterator for Cookies created via play.api.test.Helpers.cookies (backport #13317) by @murosan
• #13284 [2.9.x] Fix ClassCastException when using @With Java annotation (backport #13282) by @mkurz

Full Changelog

Following pull requests got merged for this release:

• #13356 [2.9.x] sbt 1.11.2 everywhere by @mkurz
• #13306 [2.9.x] sbt-ci-release 1.11.1 (was 1.9.3) by @scala-steward
• #13309 [2.9.x] sbt, sbt-dependency-tree, ... 1.11.2 (was 1.10.11) by @scala-steward
• #13352 [2.9.x] Upgrade play-json by @mkurz
• #13350 [2.9.x] Twirl upgrade by @mkurz
• #13338 [2.9.x] hibernate-core 6.6.19.Final (was 6.6.18.Final) by @mkurz
• #13340 [2.9.x] Patch updates by @mkurz
• #13347 [2.9.x] Fix groupid in scala steward conf (backport #13346) by @mkurz
• #13332 [2.9.x] sbt-java-formatter 0.10.0 (was 0.8.0) (backport #13251) by @scala-steward
• #13331 [2.9.x] hibernate-core 6.6.18.Final (was 6.6.15.Final) (backport #13324) by @scala-steward
• #13330 [2.9.x] Pin caffeine (backport #13329) by @mkurz
• #13327 [2.9.x] Fix iterator for Cookies created via play.api.test.Helpers.cookies (backport #13317) by @murosan
• #13313 [2.9.x] Pin Hibernate ORM to 6.x (backport #13312) by @mkurz
• #13310 [2.9.x] Patch updates by @scala-steward
• #13308 [2.9.x] hibernate-core 6.6.17.Final (was 6.6.13.Final) by @scala-steward
• #13307 [2.9.x] netty-codec-http, netty-handler, ... 4.1.122.Final (was 4.1.121.Final) by @scala-steward
• #13299 [2.9.x] Upgrade commons-beanutils to fix CVE-2025-48734 (backport #13297) by @mkurz
• #13284 [2.9.x] Fix ClassCastException when using @With Java annotation (backport #13282) by @mkurz
• #13277 [2.9.x] docs: add note about known bug with logger configuration (backport #13275) by @gaeljw
• #13267 [2.9.x] commons-io 2.19.0 (was 2.18.0) by @scala-steward
• #13270 [2.9.x] Patch updates by @scala-steward
• #13268 [2.9.x] netty-codec-http, netty-handler, ... 4.1.121.Final (was 4.1.119.Final) by @scala-steward
• #13248 [2.9.x] Use ubuntu-24.04 GHA runner image (backport #13107) by @mkurz
• #13241 [2.9.x] Pin Netty to 4.1.x by @mkurz
• #13237 [2.9.x] Patch updates by @scala-steward
• #13236 [2.9.x] hibernate-core 6.6.13.Final (was 6.6.10.Final) by @scala-steward
• #13207 [2.9.x] Fix Heroku deprecated toolbelt URL on ProductionHeroku.md (backport #13205) by @bidego

For more details see the full list of changes and the 2.9.8 milestone.

❤️ Thanks to our premium sponsors!

If you find this OSS project useful for work, please consider asking your company to support it by becoming a sponsor.
You can also individually sponsor the project by becoming a backer.

🙇 Thanks to our contributors

Finally, thanks to the community for their help with detailed bug reports, discussions about new features and pull request reviews. This project is only possible due to the help we had from amazing contributors.
Special thanks to all code contributors who helped with this particular release (they are listed below)!

The Play Team is happy to announce the release of Play 3.0.7.

📗 About this Release

This patch release primarily upgrades dependencies, fixes minor bugs, and improves compatibility with Scala 3. We recommend upgrading as soon as possible.

If you're considering upgrading to Play 3.0, please check the Play 3.0 release announcement for highlights and further details on how to migrate. Many projects have already smoothly upgraded to Play 3.0.

Noteworthy Pull Request

• #13115 [3.0.x] Avoid error at shutdown if tmpdir is not writeable but was not used in the first place (backport #13039) by @gaeljw
• #13112 [3.0.x] Module: Accept constructor with (com.typesafe.config.Config) (backport #13044) by @tsawada
• #13005 [3.0.x] Change access modifier to package private for RoutingDsl.{Route,RouteParam} (backport #13003) by @WojciechMazur

Full Changelog

Following pull requests got merged for this release:

• #13189 [3.0.x] Patch updates by @mkurz
• #13188 [3.0.x] hibernate-core 6.6.10.Final (was 6.6.9.Final) by @mkurz
• #13172 [3.0.x] Patch updates by @mkurz
• #13171 [3.0.x] netty-codec-http, netty-handler, ... 4.1.119.Final (was 4.1.118.Final) by @mkurz
• #13166 [3.0.x] Avoid outdated commons-io in htmlunit and fluentlenium (backport #13164) by @mkurz
• #13156 [3.0.x] hibernate-core 6.6.9.Final (was 6.6.8.Final) by @mkurz
• #13158 [3.0.x] Patch updates by @mkurz
• #13157 [3.0.x] scalafmt-core 3.9.1 (was 3.8.6) by @mkurz
• #13147 [3.0.x] Explicitly submit the root project's dependency (backport #13145) by @mkurz
• #13143 [3.0.x] Scala 3.3.5 in docs (backport #13141) by @mkurz
• #13135 [3.0.x] hibernate-core 6.6.8.Final (was 6.6.5.Final) by @scala-steward
• #13134 [3.0.x] netty-codec-http, netty-handler, ... 4.1.118.Final (was 4.1.117.Final) by @scala-steward
• #13136 [3.0.x] Patch updates by @scala-steward
• #13130 [3.0.x] Documentation update: Add VSCode and url fixes to IDE page (backport #13014) by @TimothyFothergill
• #13126 [3.0.x] Eager bindings docs clarification (backport #12896) by @RommelTJ
• #13128 [3.0.x] Documentation Update: Asset timestamp handling with sbt (backport #12895) by @RommelTJ
• #13124 [3.0.x] Updates Custom Field Constructor Documentation (backport #12892) by @RommelTJ
• #13121 [3.0.x] Update link on how to fix slow localhost resolution (backport #13120) by @mkurz
• #13115 [3.0.x] Avoid error at shutdown if tmpdir is not writeable but was not used in the first place (backport #13039) by @gaeljw
• #13113 [3.0.x] Add example and fix doc for asynchronous accepting WebSocket (backport #13035) by @ihostage
• #13112 [3.0.x] Module: Accept constructor with (com.typesafe.config.Config) (backport #13044) by @tsawada
• #13086 [3.0.x] Fix apiMappings (backport #13085) by @mkurz
• #13078 [3.0.x] hibernate-core 6.6.5.Final (was 6.6.4.Final) by @scala-steward
• #13076 [3.0.x] Patch updates by @mkurz
• #13073 [3.0.x] Patch updates by @mkurz
• #13068 [3.0.x] Prepare scalafmt upgrade (backport #13066) by @mkurz
• #13064 [3.0.x] netty-codec-http, netty-handler, ... 4.1.117.Final (was 4.1.116.Final) by @mkurz
• #13063 [3.0.x] sbt-native-packager 1.11.0 (was 1.10.4) by @mkurz
• #13065 [3.0.x] Patch updates by @mkurz
• #13048 [3.0.x] Scala 2.13.16 (backport #13047) by @mkurz
• #13033 [3.0.x] Fix Dependency Graph action (backport #13032) by @ihostage
• #13027 [3.0.x] Fix Microbenchmark tests to make it work with upcoming Scala releases (backport #13025) by @mkurz
• #13018 [3.0.x] Patch updates by @scala-steward
• #13016 [3.0.x] netty-codec-http, netty-handler, ... 4.1.116.Final (was 4.1.115.Final) by @scala-steward
• #13017 [3.0.x] hibernate-core 6.6.4.Final (was 6.6.3.Final) by @scala-steward
• #13005 [3.0.x] Change access modifier to package private for RoutingDsl.{Route,RouteParam} (backport #13003) by @WojciechMazur
• #13000 [3.0.x] sbt 1.10.6 (backport #12998) by @mkurz

For more details see the full list of changes and the 3.0.7 milestone.

❤️ Thanks to our premium sponsors!

If you find this OSS project useful for work, please consider asking your company to support it by becoming a sponsor.
You can also individually sponsor the project by becoming a backer.

🙇 Thanks to our contributors

Finally, thanks to the community for their help with detailed bug reports, discussions about new features and pull request reviews. This project is only possible due to the help we had from amazing contributors.
Special thanks to all code contributors who helped with this particular release (they are listed below)!

The Play Team is happy to announce the release of Play 2.9.7.

📗 About this Release

This patch release primarily upgrades dependencies, fixes minor bugs, and improves compatibility with Scala 3. We recommend upgrading as soon as possible.

If you're considering upgrading to Play 2.9, please check the Play 2.9 release announcement for highlights and further details on how to migrate. Many projects have already smoothly upgraded to Play 2.9.

Noteworthy Pull Request

• #13116 [2.9.x] Avoid error at shutdown if tmpdir is not writeable but was not used in the first place (backport #13039) by @gaeljw
• #13111 [2.9.x] Module: Accept constructor with (com.typesafe.config.Config) (backport #13044) by @tsawada
• #13006 [2.9.x] Change access modifier to package private for RoutingDsl.{Route,RouteParam} (backport #13003) by @WojciechMazur

Full Changelog

Following pull requests got merged for this release:

• #13187 [2.9.x] Patch updates by @mkurz
• #13186 [2.9.x] hibernate-core 6.6.10.Final (was 6.6.9.Final) by @mkurz
• #13180 [2.9.x] Patch updates by @scala-steward
• #13170 [2.9.x] Patch updates by @mkurz
• #13169 [2.9.x] netty-codec-http, netty-handler, ... 4.1.119.Final (was 4.1.118.Final) by @mkurz
• #13165 [2.9.x] Avoid outdated commons-io in htmlunit and fluentlenium (backport #13164) by @mkurz
• #13152 [2.9.x] hibernate-core 6.6.9.Final (was 6.6.6.Final) by @mkurz
• #13154 [2.9.x] Patch updates by @mkurz
• #13151 [2.9.x] netty-codec-http, netty-handler, ... 4.1.118.Final (was 4.1.117.Final) by @mkurz
• #13153 [2.9.x] scalafmt-core 3.9.1 (was 3.8.6) by @mkurz
• #13146 [2.9.x] Explicitly submit the root project's dependency (backport #13145) by @mkurz
• #13144 [2.9.x] Scala 3.3.5 in docs (backport #13141) by @mkurz
• #13131 [2.9.x] Documentation update: Add VSCode and url fixes to IDE page (backport #13014) by @TimothyFothergill
• #13129 [2.9.x] Documentation Update: Asset timestamp handling with sbt (backport #12895) by @RommelTJ
• #13127 [2.9.x] Eager bindings docs clarification (backport #12896) by @RommelTJ
• #13125 [2.9.x] Updates Custom Field Constructor Documentation (backport #12892) by @RommelTJ
• #13122 [2.9.x] Update link on how to fix slow localhost resolution (backport #13120) by @mkurz
• #13116 [2.9.x] Avoid error at shutdown if tmpdir is not writeable but was not used in the first place (backport #13039) by @gaeljw
• #13114 [2.9.x] Add example and fix doc for asynchronous accepting WebSocket (backport #13035) by @ihostage
• #13111 [2.9.x] Module: Accept constructor with (com.typesafe.config.Config) (backport #13044) by @tsawada
• #13103 [2.9.x] hibernate-core 6.6.6.Final (was 6.6.4.Final) by @scala-steward
• #13104 [2.9.x] Patch updates by @scala-steward
• #13085 [2.9.x] Fix apiMappings by @mkurz
• #13075 [2.9.x] Patch updates by @mkurz
• #13072 [2.9.x] Patch updates by @mkurz
• #13067 [2.9.x] Prepare scalafmt upgrade (backport #13066) by @mkurz
• #13061 [2.9.x] netty-codec-http, netty-handler, ... 4.1.117.Final (was 4.1.116.Final) by @mkurz
• #13060 [2.9.x] sbt-native-packager 1.11.0 (was 1.10.4) by @mkurz
• #13062 [2.9.x] Patch updates by @mkurz
• #13049 [2.9.x] Scala 2.13.16 (backport #13047) by @mkurz
• #13038 [2.9.x] Patch updates by @scala-steward
• #13037 [2.9.x] hibernate-core 6.6.4.Final (was 6.6.3.Final) by @scala-steward
• #13034 [2.9.x] Fix Dependency Graph action (backport #13032) by @ihostage
• #13026 [2.9.x] Fix Microbenchmark tests to make it work with upcoming Scala releases (backport #13025) by @mkurz
• #13023 [2.9.x] netty-codec-http, netty-handler, ... 4.1.116.Final (was 4.1.115.Final) (backport #13016) by @scala-steward
• #13006 [2.9.x] Change access modifier to package private for RoutingDsl.{Route,RouteParam} (backport #13003) by @WojciechMazur
• #12999 [2.9.x] sbt 1.10.6 (backport #12998) by @mkurz

For more details see the full list of changes and the 2.9.7 milestone.

❤️ Thanks to our premium sponsors!

If you find this OSS project useful for work, please consider asking your company to support it by becoming a sponsor.
You can also individually sponsor the project by becoming a backer.

🙇 Thanks to our contributors

Finally, thanks to the community for their help with detailed bug reports, discussions about new features and pull request reviews. This project is only possible due to the help we had from amazing contributors.
Special thanks to all code contributors who helped with this particular release (they are listed below)!

The Play Team is pleased to announce the release of Play 3.0.6! 🎉

📗 About this Release

Play is pretty stable at this point - we hardly get bug reports, which is great! This release primarily upgrades dependencies, and we strongly recommend upgrading at your earliest convenience.

If you're considering upgrading to Play 3.0, please check the Play 3.0 release announcement for highlights and further details on how to migrate. Many projects have already smoothly upgraded to Play 3.0.

Noteworthy Pull Request

• playframework/play-ws #866 Use latest netty-reactive-streams version, ahc comes with outdated one by @mkurz
  • Ensures the shaded AsyncHttpClient dependency shipped with play-ws uses the latest Netty release. This resolves an issue where AsyncHttpClient depended on an outdated version of netty-reactive-streams, which also pulled in an outdated Netty release. Now everything is up-to-date.
• #12818 [3.0.x] Fix jjwt 0.12 compatibility for setExpiration method by @PromanSEW

Full Changelog

Following pull requests got merged for this release:

• #12992 [3.0.x] hibernate-core 6.6.3.Final (was 6.6.2.Final) by @mkurz
• #12974 [3.0.x] play-ws 3.0.6 by @mkurz
• #12971 [3.0.x] netty-reactive-streams-http 3.0.3 (was 3.0.2) by @mkurz
• #12963 [3.0.x] Netty 4.1.115.Final by @mkurz
• #12961 [3.0.x] Pin joda-convert by @mkurz
• #12955 [3.0.x] sbt-ci-release 1.9.0 (was 1.8.0) by @mkurz
• #12954 [3.0.x] sbt-buildinfo 0.13.1 (was 0.12.0) by @mkurz
• #12959 [3.0.x] Patch updates by @mkurz
• #12957 [3.0.x] hibernate-core 6.6.2.Final (was 6.6.1.Final) by @mkurz
• #12956 [3.0.x] sbt-pekko-version-check 0.0.7 (was 0.0.5) by @mkurz
• #12906 [3.0.x] Patch updates by @scala-steward
• #12905 [3.0.x] hibernate-core 6.6.1.Final (was 6.6.0.Final) by @scala-steward
• #12904 [3.0.x] netty-codec-http, netty-handler, ... 4.1.114.Final (was 4.1.113.Final) by @scala-steward
• #12903 [3.0.x] sbt-ci-release 1.8.0 (was 1.6.1) by @scala-steward
• #12916 [3.0.x] Fix broken link (backport #12914) by @sf17490
• #12908 [3.0.x] Rename stale-on-error to stale-if-error (backport #12902) by @alexmuller
• #12890 [3.0.x] Scala Steward: Pin joda-time by @mkurz
• #12871 [3.0.x] Upgrade scala (2.13 + 3.3) and sbt (backport #12868) by @mkurz
• #12860 [3.0.x] Patch updates by @scala-steward
• #12869 [3.0.x] Pin Pekko [HTTP] to 1.0.x by @mkurz
• #12851 [3.0.x] Netty 4.1.113 (backport #12846) by @mkurz
• #12849 [3.0.x] Scala 2.12.20 (backport #12845) by @mkurz
• #12832 [3.0.x] Patch updates by @scala-steward
• #12830 [3.0.x] sbt-ci-release 1.6.0 (was 1.5.12) by @scala-steward
• #12831 [3.0.x] hibernate-core 6.6.0.Final (was 6.5.2.Final) by @scala-steward
• #12818 [3.0.x] Fix jjwt 0.12 compatibility for setExpiration method by @PromanSEW

For more details see the full list of changes and the 3.0.6 milestone.

❤️ Thanks to our premium sponsors!

If you find this OSS project useful for work, please consider asking your company to support it by becoming a sponsor.
You can also individually sponsor the project by becoming a backer.

🙇 Thanks to our contributors

Finally, thanks to the community for their help with detailed bug reports, discussions about new features and pull request reviews. This project is only possible due to the help we had from amazing contributors.
Special thanks to all code contributors who helped with this particular release (they are listed below)!

The Play Team is pleased to announce the release of Play 2.9.6! 🎉

📗 About this Release

Play is pretty stable at this point - we hardly get bug reports, which is great! This release primarily upgrades dependencies, and we strongly recommend upgrading at your earliest convenience.

If you're considering upgrading to Play 2.9, please check the Play 2.9 release announcement for highlights and further details on how to migrate. Many projects have already smoothly upgraded to Play 2.9.

Noteworthy Pull Request

• playframework/play-ws #866 Use latest netty-reactive-streams version, ahc comes with outdated one by @mkurz
  • Ensures the shaded AsyncHttpClient dependency shipped with play-ws uses the latest Netty release. This resolves an issue where AsyncHttpClient depended on an outdated version of netty-reactive-streams, which also pulled in an outdated Netty release. Now everything is up-to-date.
• #12820 [2.9.x] Fix jjwt 0.12 compatibility for setExpiration method (backport #12818) by @PromanSEW

Full Changelog

Following pull requests got merged for this release:

• #12990 [2.9.x] hibernate-core 6.6.3.Final (was 6.6.2.Final) by @mkurz
• #12973 [2.9.x] play-ws 2.2.10 by @mkurz
• #12970 [2.9.x] netty-reactive-streams-http 2.0.13 (was 2.0.12) by @mkurz
• #12962 [2.9.x] Netty 4.1.115.Final by @mkurz
• #12960 [2.9.x] Pin joda-convert by @mkurz
• #12950 [2.9.x] sbt-buildinfo 0.13.1 (was 0.12.0) by @mkurz
• #12953 [2.9.x] Patch updates by @mkurz
• #12951 [2.9.x] hibernate-core 6.6.2.Final (was 6.6.1.Final) by @mkurz
• #12935 [2.9.x] Patch updates by @scala-steward
• #12933 [2.9.x] sbt-akka-version-check 0.4 (was 0.3) by @scala-steward
• #12934 [2.9.x] netty-codec-http, netty-handler, ... 4.1.114.Final (was 4.1.113.Final) by @scala-steward
• #12932 [2.9.x] sbt-ci-release 1.9.0 (was 1.6.1) by @scala-steward
• #12917 [2.9.x] Fix broken link (backport #12914) by @sf17490
• #12909 [2.9.x] Rename stale-on-error to stale-if-error (backport #12902) by @alexmuller
• #12885 [2.9.x] Patch updates by @scala-steward
• #12889 [2.9.x] Scala Steward: Pin joda-time by @mkurz
• #12884 [2.9.x] hibernate-core 6.6.1.Final (was 6.6.0.Final) by @scala-steward
• #12872 [2.9.x] Upgrade scala (2.13 + 3.3) and sbt (backport #12868) by @mkurz
• #12848 [2.9.x] Scala 2.12.20 (backport #12845) by @mkurz
• #12850 [2.9.x] Netty 4.1.113 (backport #12846) by @mkurz
• #12839 [2.9.x] hibernate-core 6.6.0.Final (was 6.5.2.Final) by @scala-steward
• #12838 [2.9.x] sbt-ci-release 1.6.1 (was 1.5.12) by @scala-steward
• #12820 [2.9.x] Fix jjwt 0.12 compatibility for setExpiration method (backport #12818) by @PromanSEW

For more details see the full list of changes and the 2.9.6 milestone.

❤️ Thanks to our premium sponsors!

If you find this OSS project useful for work, please consider asking your company to support it by becoming a sponsor.
You can also individually sponsor the project by becoming a backer.

🙇 Thanks to our contributors

Finally, thanks to the community for their help with detailed bug reports, discussions about new features and pull request reviews. This project is only possible due to the help we had from amazing contributors.
Special thanks to all code contributors who helped with this particular release (they are listed below)!