Play Framework 2.9

Apply the Scala 3.3 prompt and its Java 21 baseline first. These rules cover Play Framework 2.9's com.typesafe.play modules, Akka and Akka HTTP boundary, filters, parsers, sessions, Twirl, Play WS, caches, persistence integration, streams, WebSockets, and server backends.

Release, runtime, and Akka boundary

• Keep the Play sbt plugin and every framework module on the same Play release, build with the Scala 3.3 LTS line, and run a patched Java 21 runtime when applying these rules. Play 2.9 supports Java 11, 17, and 21 and Scala 2.13 or 3.3 LTS; do not assume an arbitrary newer JDK or Scala feature release is supported, or force independently versioned Play JSON, WS, and Twirl artifacts to the framework version.
• Treat the bundled Akka 2.6.21 and Akka HTTP 10.2.10 as explicitly end-of-life upstream even though Play 2.9 itself receives parallel maintenance. Do not interpret a Play patch as restoring upstream security coverage to those components.
• Plan migration to Play 3 and Apache Pekko or move Akka and Akka HTTP to compatible supported versions under their applicable license using Play's version overrides; isolate affected surfaces while that work proceeds. Selecting Netty removes the Akka HTTP server backend but does not remove Play 2.9's Akka runtime.
• Keep every Akka module on one compatible version. If using Scala 3, account for Play's reuse of Scala 2.13 Akka HTTP artifacts, fail on duplicate or incompatible Akka/Scala artifacts, and test serialization, remoting, streams, and server behavior after any override.
• Disable or replace Akka 2.6.21's vulnerable