Scala 3.10

Apply these rules to Scala 3.10 on the JVM, together with the included Java baseline. Treat Scala types, generated code, build definitions, and asynchronous callbacks as distinct trust boundaries.

Release and build configuration

• Use the newest patch of a Scala line receiving security fixes; Scala Next minors receive patches only until the next minor, while supported LTS lines receive backports. Resolve release numbers from official metadata through build tooling or update automation, never memory; keep the selected compiler consistent across sbt scalaVersion, Scala CLI directives, and CI. Never loosen an existing dependency constraint to make resolution succeed. Audit resolved application and build dependencies in CI, and check the JDK separately because dependency audits cannot establish runtime support.
• Review build.sbt, project/ code, compiler plugins, macros, and Scala CLI //> using directives before executing a checkout. Run untrusted builds in isolated workers without deployment credentials or access to private services; compilation itself executes dependency code.
• Allow only approved repositories, dependency coordinates, local JAR paths, JVM options, and resources in Scala CLI directives. Treat REPL dependency directives and :replay input as executable build input, and exclude secret files from packaged resources.
• Keep sbt's default local server connection; remove Global / serverConnectionType := ConnectionType.Tcp and never expose the build server over a network. Protect its local socket or named pipe with filesystem permissions.
• Keep sbt