The Play Team is happy to announce the release of Play 2.8.19 🥳

📗 What is new?

ping/pong support for WebSockets 🏓

Finally! Check out the documentation:

• WebSockets Play Scala
• WebSockets Play Java

Using Netty, WebSockets time out now ⏳

Another fix for WebSockets ships with this release as well:
If you are using the Netty backend the play.server.http[s].idleTimeout setting will now be honored for WebSocket connections. Until now, when using Netty, a WebSocket connection never timed out. That might even was desirable for some use cases, but now that we have ping/pong support you have to make use of that to keep WebSocket connections open. That is the correct way of doing things and not closing connections after an idle timeout was actually a bug. The akka-http backend was always working correctly and didn't need to be fixed.

Removed the shutdown hook from the default logback config 🪝

If you have

<shutdownHook class="ch.qos.logback.core.hook.DelayingShutdownHook"/>

in your logback config, you should remove that line. Play handles the shutdown of the logger context, the line shown is not necassary anymore since at least Play 2.7 and is a leftover that should have been removed a while ago. More details can be found in the according pull request.

Correctly encode Content-Disposition: form-data; name="..."; filename="..." 🔠

When Play renders a request body containing multipart/form data it will now encode the name and the filename fields according the "WHATWG HTML living standard" section 4.10.21.8. curl, Firefox, Chrome and other libraries like Python's urllib3 follow the same approach. Until now, Play didn't encode those fields which could result in security implications. Just to be clear, this is not about receiving and parsing multipart/form data from a client, but when sending multipart/form data e.g. via ws or when using the RequestBuilder to build a request for testing purposes. Details can be found in pull request #11571.

A few words on Play's compatibility with sbt 1.8 🔧

Now that sbt 1.8 got released there have been reports that it isn't working out of the box with Play, caused by a version conflict regarding scala-xml, see #11522. Unfortunately, right now, we don't have a fix for that yet. Even if we bump scala-xml to version 2.x in Play and all its dependencies, we can't currently make sbt 1.8 work with Play because of another problem described in #11527.
The good news is, that isn't a showstopper if you still want to upgrade to sbt 1.8. You can do that right now by putting

ThisBuild / libraryDependencySchemes += "org.scala-lang.modules" %% "scala-xml" % VersionScheme.Always

in project/plugins.sbt. That is possible because scala-xml 1.x and 2.x are compatible anyway. However, like described in #11527 you will not be able to use PlayNonBlockingInteractionMode with sbt 1.8 then (which probably not many people do anyway)

Further roadmap 🗺️

...news coming soon...

Merged pull requests

Following pull requests got merged for this release:

• #11604 [2.8.x] Upgrade netty + netty reactive streams + fix backports by @mkurz
• #11603 [2.8.x] Escape Content-Disposition params according to WHATWG HTML living standard (backport #11571) by @mkurz
• #11602 [2.8.x] Add exceptionOverrideClassName Hikari config setting (backport #11601) by @benwaffle
• #11598 [2.8.x] Fix the example code to DiscardingCookie for Results#discardingCookies (backport #11597) by @tsuyoshizawa
• #11593 Update PlayApplicationOverview.md by @SenthilNayagan
• #11528 [2.8.x] Upgrade Scalafmt to latest release of 2.4.x serias (backport #11524) by @ihostage
• #11567 [2.8.x] Added play-hmac-signatures (backport #11559) by @phelps-sg
• #11560 [2.8.x] Updating documentation - ConfiguringHttps.md by @szymond
• #11552 Update SettingsJDBC.md by @bmontuelle
• #11532 [2.8.x] Do not use/recommend shutdownHook in Logback, Play handles that by @mkurz
• #11519 [2.8.x] Log websocket communication problems + handle special Netty case by @mkurz
• #11521 [2.8.x] Add WebSocket ping/pong support by @mkurz
• #11420 [2.8.x] Netty: Websockets should respect play.server.http.idleTimeout by @mkurz
• #11518 [2.8.x] Use environment file instead set-output by @ihostage

For more details see the full list of changes and the 2.8.19 milestone.

❤️ Thanks to our premium sponsors!

If you find this OSS project useful for work, please consider asking your company to support it by becoming a sponsor.
You can also individually sponsor the project by becoming a backer.

🙇 Thanks to our contributors

Finally, thanks to the community for their help with detailed bug reports, discussions about new features and pull request reviews. This project is only possible due to the help we had from amazing contributors.
Special thanks to all code contributors who helped with this particular release (they are listed below)!