Play 3.0.10

[mkurz]

We are pleased to announce the release of Play 3.0.10! 🎉

📗 About this Release

This release fixes several bugs and addresses reported security vulnerabilities (CVEs) and - as always - updates dependencies. We strongly recommend upgrading at your earliest convenience.

If you're considering upgrading to Play 3.0, please check the Play 3.0 release announcement for highlights and further details on how to migrate. Many projects have already smoothly upgraded to Play 3.0.

Noteworthy Pull Request

• [3.0.x] Avoid running out of memory when parsing heavily nested arrays or objects (backport #1226) by @mkurz play-json#1228 [3.0.x] Avoid running out of memory when parsing heavily nested arrays or objects by @mkurz
  We now limit the maximum allowed nesting depth of JSON structures (arrays, objects, or a mix of both) to 1000.
  This limit can be adjusted using the system property play.json.parser.maxNestingDepth.
  We assume a depth of 1000 should be more than sufficient for virtually all real-world use cases.
  This change helps prevent both potential OutOfMemoryErrors and StackOverflowErrors.
  The latter, however, is not a concern for Play JSON, since it already uses a @tailrec-optimized parsing method.
  As a result, Play JSON is not affected by GHSA-h46c-h94j-95f3, which specifically addresses StackOverflowError risks.
  This improvement is simply an additional safety measure.
• [3.0.x] Bump to lz4-java 1.10.1 to fix CVE-2025-66566  #13684 [3.0.x] Bump to lz4-java 1.10.1 to fix CVE-2025-66566 and CVE‐2025‐12183 by @mkurz
• [3.0.x] Netty 4.1.130.Final #13706 [3.0.x] Netty 4.1.130.Final to fix CVE-2025-67735 by @mkurz
• Upgrade ch.qos.logback:logback-core to fix CVE-2025-11226 (see "Patch updates" below)

Following pull requests got merged for this release:

• [3.0.x] Patch updates #13717 [3.0.x] Patch updates by @mkurz
• [3.0.x] Patch updates #13712 [3.0.x] Patch updates by @scala-steward
• [3.0.x] Netty 4.1.130.Final #13706 [3.0.x] Netty 4.1.130.Final by @mkurz
• [3.0.x] hibernate-core 6.6.39.Final (was 6.6.38.Final) #13705 [3.0.x] hibernate-core 6.6.39.Final (was 6.6.38.Final) by @scala-steward
• [3.0.x] Patch updates #13693 [3.0.x] Patch updates by @mkurz
• [3.0.x] netty-codec-http, netty-handler, ... 4.1.129.Final (was 4.1.128.Final) #13691 [3.0.x] netty-codec-http, netty-handler, ... 4.1.129.Final (was 4.1.128.Final) by @mkurz
• [3.0.x] Bump to lz4-java 1.10.1 to fix CVE-2025-66566  #13684 [3.0.x] Bump to lz4-java 1.10.1 to fix CVE-2025-66566 by @mkurz
• [3.0.x] lz4-java 1.8.1 #13682 [3.0.x] lz4-java 1.8.1 by @mkurz
• [3.0.x] hibernate-core 6.6.38.Final (was 6.6.37.Final) #13679 [3.0.x] hibernate-core 6.6.38.Final (was 6.6.37.Final) by @scala-steward
• [3.0.x] Patch updates #13674 [3.0.x] Patch updates by @scala-steward
• [3.0.x] Bump actions/checkout from 5 to 6 #13670 [3.0.x] Bump actions/checkout from 5 to 6 by @dependabot[bot]
• [3.0.x] hibernate-core 6.6.37.Final (was 6.6.36.Final) #13668 [3.0.x] hibernate-core 6.6.37.Final (was 6.6.36.Final) by @scala-steward
• [3.0.x] hibernate-core 6.6.36.Final (was 6.6.35.Final) #13662 [3.0.x] hibernate-core 6.6.36.Final (was 6.6.35.Final) by @scala-steward
• [3.0.x] hibernate-core 6.6.35.Final (was 6.6.34.Final) #13660 [3.0.x] hibernate-core 6.6.35.Final (was 6.6.34.Final) by @scala-steward
• [3.0.x] Patch updates #13658 [3.0.x] Patch updates by @scala-steward
• [3.0.x] commons-io 2.21.0 (was 2.20.0) #13637 [3.0.x] commons-io 2.21.0 (was 2.20.0) by @scala-steward
• [3.0.x] Patch updates #13632 [3.0.x] Patch updates by @scala-steward
• [3.0.x] hibernate-core 6.6.34.Final (was 6.6.33.Final) #13625 [3.0.x] hibernate-core 6.6.34.Final (was 6.6.33.Final) by @scala-steward
• [3.0.x] Patch updates #13611 [3.0.x] Patch updates by @mkurz
• [3.0.x] Pin ssl-config (backport #13612) by @mkurz #13613 [3.0.x] Pin ssl-config (backport [2.9.x] Pin ssl-config #13612) by @mkurz
• [3.0.x] scalafmt-core 3.10.0 (was 3.9.10) #13605 [3.0.x] scalafmt-core 3.10.0 (was 3.9.10) by @scala-steward
• [3.0.x] hibernate-core 6.6.33.Final (was 6.6.31.Final) #13603 [3.0.x] hibernate-core 6.6.33.Final (was 6.6.31.Final) by @scala-steward
• [3.0.x] netty-codec-http, netty-handler, ... 4.1.128.Final (was 4.1.127.Final) #13607 [3.0.x] netty-codec-http, netty-handler, ... 4.1.128.Final (was 4.1.127.Final) by @scala-steward
• [3.0.x] Patch updates #13597 [3.0.x] Patch updates by @scala-steward
• [3.0.x] hibernate-core 6.6.31.Final (was 6.6.30.Final) #13594 [3.0.x] hibernate-core 6.6.31.Final (was 6.6.30.Final) by @scala-steward
• [3.0.x] Patch updates #13588 [3.0.x] Patch updates by @scala-steward
• [3.0.x] sbt-native-packager 1.11.4 (backport #13584) by @mkurz #13586 [3.0.x] sbt-native-packager 1.11.4 (backport sbt-native-packager 1.11.4 #13584) by @mkurz
• [3.0.x] sbt-jmh 0.4.8 (was 0.4.7) #13570 [3.0.x] sbt-jmh 0.4.8 (was 0.4.7) by @scala-steward
• [3.0.x] hibernate-core 6.6.30.Final (was 6.6.29.Final) #13569 [3.0.x] hibernate-core 6.6.30.Final (was 6.6.29.Final) by @scala-steward
• [3.0.x] h2 2.4.240 (was 2.3.232) #13561 [3.0.x] h2 2.4.240 (was 2.3.232) by @scala-steward
• [3.0.x] Patch updates #13551 [3.0.x] Patch updates by @scala-steward
• [3.0.x] hibernate-core 6.6.29.Final (was 6.6.28.Final) #13545 [3.0.x] hibernate-core 6.6.29.Final (was 6.6.28.Final) by @scala-steward
• [3.0.x] sbt-header 5.11.0 (was 5.10.0) #13541 [3.0.x] sbt-header 5.11.0 (was 5.10.0) by @scala-steward

For more details see the full list of changes and the 3.0.10 milestone.

❤️ Thanks to our premium sponsors!

If you find this OSS project useful for work, please consider asking your company to support it by becoming a sponsor.
You can also individually sponsor the project by becoming a backer.

🙇 Thanks to our contributors

Finally, thanks to the community for their help with detailed bug reports, discussions about new features and pull request reviews. This project is only possible due to the help we had from amazing contributors.
Special thanks to all code contributors who helped with this particular release (they are listed below)!

---

This discussion was created from the release Play 3.0.10.

[Squeng]

Thanks, @mkurz, and Merry Christmas!