deps: bump the library-dependencies group across 1 directory with 57 updates

[dependabot]

Bumps the library-dependencies group with 57 updates in the / directory:

Package	From	To
jvm	2.0.21	2.4.10
io.ktor.plugin	3.5.0	3.5.1
org.jetbrains.kotlinx.kover	0.9.8	0.9.9
me.champeau.jmh	0.7.2	0.7.3
plugin.serialization	2.4.0	2.4.10
io.github.darkryh.katalyst:katalyst-conventions	1.0.0-alpha02	1.0.0-alpha05
org.jetbrains.intellij.platform	2.6.0	2.18.1
io.ktor:ktor-server-core	3.5.0	3.5.1
io.ktor:ktor-server-content-negotiation	3.5.0	3.5.1
io.ktor:ktor-server-auth	3.5.0	3.5.1
io.ktor:ktor-server-auth-jwt	3.5.0	3.5.1
io.ktor:ktor-server-status-pages	3.5.0	3.5.1
io.ktor:ktor-server-websockets	3.5.0	3.5.1
io.ktor:ktor-server-call-id	3.5.0	3.5.1
io.ktor:ktor-server-rate-limit	3.5.0	3.5.1
io.ktor:ktor-serialization-kotlinx-json	3.5.0	3.5.1
io.ktor:ktor-server-test-host	3.5.0	3.5.1
io.ktor:ktor-server-host-common	3.5.0	3.5.1
io.ktor:ktor-server-netty	3.5.0	3.5.1
io.ktor:ktor-server-cio	3.5.0	3.5.1
io.ktor:ktor-server-jetty-jakarta	3.5.0	3.5.1
io.ktor:ktor-server-config-yaml	3.5.0	3.5.1
io.ktor:ktor-client-websockets	3.5.0	3.5.1
io.ktor:ktor-client-core	3.5.0	3.5.1
io.ktor:ktor-client-cio	3.5.0	3.5.1
io.github.darkryh.dispatch:dispatch-core	1.0.0-beta02	1.0.0-beta03
io.github.darkryh.dispatch:dispatch-widgets	1.0.0-beta02	1.0.0-beta03
io.github.darkryh.dispatch:dispatch-navigation	1.0.0-beta02	1.0.0-beta03
io.github.darkryh.dispatch:dispatch-viewmodel	1.0.0-beta02	1.0.0-beta03
io.github.darkryh.dispatch:dispatch-layout	1.0.0-beta02	1.0.0-beta03
io.github.darkryh.dispatch:dispatch-lifecycle	1.0.0-beta02	1.0.0-beta03
org.jetbrains.exposed:exposed-core	1.3.0	1.3.1
org.jetbrains.exposed:exposed-dao	1.3.0	1.3.1
org.jetbrains.exposed:exposed-jdbc	1.3.0	1.3.1
org.jetbrains.exposed:exposed-r2dbc	1.3.0	1.3.1
org.jetbrains.exposed:exposed-migration-core	1.3.0	1.3.1
org.jetbrains.exposed:exposed-migration-jdbc	1.3.0	1.3.1
org.jetbrains.exposed:exposed-migration-r2dbc	1.3.0	1.3.1
org.jetbrains.exposed:exposed-java-time	1.3.0	1.3.1
com.zaxxer:HikariCP	5.1.0	7.1.0
com.h2database:h2	2.3.232	2.4.240
org.postgresql:postgresql	42.7.8	42.7.13
org.ow2.asm:asm	9.7	9.10.1
io.github.damirdenis-tudor:ktor-server-rabbitmq	1.3.6	1.5.0
org.jetbrains.kotlinx:kotlinx-coroutines-core	1.10.2	1.11.0
org.jetbrains.kotlinx:kotlinx-coroutines-test	1.10.2	1.11.0
org.junit.platform:junit-platform-launcher	1.10.2	6.1.2
org.junit.jupiter:junit-jupiter-engine	5.10.2	6.1.2
ch.qos.logback:logback-classic	1.5.13	1.6.1
org.slf4j:slf4j-api	2.0.16	2.0.18
org.fusesource.jansi:jansi	2.4.0	2.4.3
org.jetbrains.kotlinx:kover-gradle-plugin	0.9.8	0.9.9
dev.kourier:amqp-client-robust-jvm	0.2.8	0.4.6
org.jetbrains.kotlinx:kotlinx-serialization-json	1.9.0	1.11.0
org.testcontainers:postgresql	1.21.3	1.21.4
org.yaml:snakeyaml	2.2	2.6
com.vanniktech:gradle-maven-publish-plugin	0.36.0	0.37.0

Updates jvm from 2.0.21 to 2.4.10

Release notes

Sourced from jvm's releases.

Kotlin 2.4.10

Changelog

Backend. Wasm

• KT-87066 K/Wasm: Not all files are presented in compiler output directory with multimodule-closed-world and incremental compilation

Compiler

• KT-86939 JVM: IllegalStateException "No value for annotation parameter" when using const val in nested Java annotation array argument
• KT-83766 K2: Wrong sourcePsi is set for SymbolPsiLiteral in SLC for annotation arguments referencing a const val
• KT-86728 Reified type inference: expected type not propagated into inline call inside lambda with elvis operator

Compose Compiler

• b/522127447 Compose Compiler 2.4: classes previously inferred stable now reported runtime/Uncertain

Klibs

• KT-86501 Native: IrTypeAliasSymbolImpl is already bound. Signature: kotlinx.datetime/Instant|null[0] on iosSimulatorArm64

Tools. CLI

• KT-86930 Introduce kotlinr in the Kotlin distribution

Tools. Gradle. BCV

• KT-87223 Gradle, BCV: open version range in kotlinAbiValidationCompatClasspath causes kotlin-build-tools-impl to resolve to 2.4.20-Beta1 instead of 2.4.0

Tools. Gradle. JS

• KT-87304 jsBrowserTest fails with "exited with errors (exit code: 1)"
• KT-86057 kotlinUpgradeYarnLock skips lock file regeneration when kotlinNpmInstall is up-to-date, causing kotlinStoreYarnLock to fail

Tools. Gradle. Multiplatform

• KT-87084 False positive warning for JS and Wasm compilations when CRI is enabled

Tools. Scripts

• KT-87076 @file:CompilerOptions("-jvm-target", ...) ignored in .main.kts scripts in Kotlin 2.4.0, falling back to JVM target 1.8
• KT-86352 K2 scripting: FirResolvedTypeRef exception when resolving extension functions from imported scripts

Kotlin 2.4.10-RC2

Changelog

Backend. Wasm

• KT-87066 K/Wasm: Not all files are presented in compiler output directory with multimodule-closed-world and incremental compilation

... (truncated)

Changelog

Sourced from jvm's changelog.

2.4.10

Backend. Wasm

• KT-87066 K/Wasm: Not all files are presented in compiler output directory with multimodule-closed-world and incremental compilation

Compiler

• KT-86939 JVM: IllegalStateException "No value for annotation parameter" when using const val in nested Java annotation array argument
• KT-83766 K2: Wrong sourcePsi is set for SymbolPsiLiteral in SLC for annotation arguments referencing a const val
• KT-86728 Reified type inference: expected type not propagated into inline call inside lambda with elvis operator

Compose Compiler

• b/522127447 Compose Compiler 2.4: classes previously inferred stable now reported runtime/Uncertain

Klibs

• KT-86501 Native: IrTypeAliasSymbolImpl is already bound. Signature: kotlinx.datetime/Instant|null[0] on iosSimulatorArm64

Tools. CLI

• KT-86930 Introduce kotlinr in the Kotlin distribution

Tools. Gradle. BCV

• KT-87223 Gradle, BCV: open version range in kotlinAbiValidationCompatClasspath causes kotlin-build-tools-impl to resolve to 2.4.20-Beta1 instead of 2.4.0

Tools. Gradle. JS

• KT-87304 jsBrowserTest fails with "exited with errors (exit code: 1)"
• KT-86057 kotlinUpgradeYarnLock skips lock file regeneration when kotlinNpmInstall is up-to-date, causing kotlinStoreYarnLock to fail

Tools. Gradle. Multiplatform

• KT-87084 False positive warning for JS and Wasm compilations when CRI is enabled

Tools. Scripts

• KT-87076 @file:CompilerOptions("-jvm-target", ...) ignored in .main.kts scripts in Kotlin 2.4.0, falling back to JVM target 1.8
• KT-86352 K2 scripting: FirResolvedTypeRef exception when resolving extension functions from imported scripts

2.4.0

Analysis API

• KT-83867 OVERLOAD_RESOLUTION_AMBIGUITY false positive with assertEquals in IJ repo
• KT-83723 [Analysis API] Enable experimental KDoc resolver by default
• KT-83388 Analysis API: properly support KMP in KotlinPackageProvider

... (truncated)

Commits

• 5687445 Add Changelog for 2.4.10-RC2
• ba30392 [Wasm] Support regenerate unchanged modules flag on KGP
• 6307e73 [Wasm] Implement Xwasm-IC-generate-unchanged-modules flag
• 39d7aee Add ChangeLog for 2.4.10-RC2
• a2956be [Gradle] Update karma.conf.js to use 'require(...)' instead plain strings
• 9b1361c [Gradle] KT-87223: Updated regression test
• a4c153a [Gradle] KT-87223: Fix toochain to 2.4.0 for abiValidation compat config
• bc04b90 Add ChangeLog for 2.4.10-RC
• bbcb94b [CRI] explicitly disable CRI generation for non-JVM targets to avoid false-po...
• 6c2c458 Scripting: fix jvmTarget processing from script annotations
• Additional commits viewable in compare view

Updates io.ktor.plugin from 3.5.0 to 3.5.1

Updates org.jetbrains.kotlinx.kover from 0.9.8 to 0.9.9

Release notes

Sourced from org.jetbrains.kotlinx.kover's releases.

0.9.9

Kover Gradle Plugin

Bugfixes

• [#818](https://github.com/Kotlin/kotlinx-kover/issues/818) Fixed Gradle 9.6.0 deprecation warning
• [#810](https://github.com/Kotlin/kotlinx-kover/issues/810) Fix 0% coverage for classes in com.android.* packages

Changelog

Sourced from org.jetbrains.kotlinx.kover's changelog.

0.9.9 / 2026-07-17

Kover Gradle Plugin

Bugfixes

• [#818](https://github.com/Kotlin/kotlinx-kover/issues/818) Fixed Gradle 9.6.0 deprecation warning
• [#810](https://github.com/Kotlin/kotlinx-kover/issues/810) Fix 0% coverage for classes in com.android.* packages

Commits

• 95de3ac Release 0.9.9
• 135968e Fixed Gradle 9.6.0 deprecation warning
• 0b7319e Applied artifacts validator plugin
• 6f712cc Fix 0% coverage for classes in com.android.* packages (#810)
• c8be110 Use local repo for publishing
• See full diff in compare view

Updates me.champeau.jmh from 0.7.2 to 0.7.3

Updates plugin.serialization from 2.4.0 to 2.4.10

Release notes

Sourced from plugin.serialization's releases.

Kotlin 2.4.10

Changelog

Backend. Wasm

• KT-87066 K/Wasm: Not all files are presented in compiler output directory with multimodule-closed-world and incremental compilation

Compiler

• KT-86939 JVM: IllegalStateException "No value for annotation parameter" when using const val in nested Java annotation array argument
• KT-83766 K2: Wrong sourcePsi is set for SymbolPsiLiteral in SLC for annotation arguments referencing a const val
• KT-86728 Reified type inference: expected type not propagated into inline call inside lambda with elvis operator

Compose Compiler

• b/522127447 Compose Compiler 2.4: classes previously inferred stable now reported runtime/Uncertain

Klibs

• KT-86501 Native: IrTypeAliasSymbolImpl is already bound. Signature: kotlinx.datetime/Instant|null[0] on iosSimulatorArm64

Tools. CLI

• KT-86930 Introduce kotlinr in the Kotlin distribution

Tools. Gradle. BCV

• KT-87223 Gradle, BCV: open version range in kotlinAbiValidationCompatClasspath causes kotlin-build-tools-impl to resolve to 2.4.20-Beta1 instead of 2.4.0

Tools. Gradle. JS

• KT-87304 jsBrowserTest fails with "exited with errors (exit code: 1)"
• KT-86057 kotlinUpgradeYarnLock skips lock file regeneration when kotlinNpmInstall is up-to-date, causing kotlinStoreYarnLock to fail

Tools. Gradle. Multiplatform

• KT-87084 False positive warning for JS and Wasm compilations when CRI is enabled

Tools. Scripts

• KT-87076 @file:CompilerOptions("-jvm-target", ...) ignored in .main.kts scripts in Kotlin 2.4.0, falling back to JVM target 1.8
• KT-86352 K2 scripting: FirResolvedTypeRef exception when resolving extension functions from imported scripts

Kotlin 2.4.10-RC2

Changelog

Backend. Wasm

• KT-87066 K/Wasm: Not all files are presented in compiler output directory with multimodule-closed-world and incremental compilation

... (truncated)

Changelog

Sourced from plugin.serialization's changelog.

2.4.10

Backend. Wasm

• KT-87066 K/Wasm: Not all files are presented in compiler output directory with multimodule-closed-world and incremental compilation

Compiler

• KT-86939 JVM: IllegalStateException "No value for annotation parameter" when using const val in nested Java annotation array argument
• KT-83766 K2: Wrong sourcePsi is set for SymbolPsiLiteral in SLC for annotation arguments referencing a const val
• KT-86728 Reified type inference: expected type not propagated into inline call inside lambda with elvis operator

Compose Compiler

• b/522127447 Compose Compiler 2.4: classes previously inferred stable now reported runtime/Uncertain

Klibs

• KT-86501 Native: IrTypeAliasSymbolImpl is already bound. Signature: kotlinx.datetime/Instant|null[0] on iosSimulatorArm64

Tools. CLI

• KT-86930 Introduce kotlinr in the Kotlin distribution

Tools. Gradle. BCV

• KT-87223 Gradle, BCV: open version range in kotlinAbiValidationCompatClasspath causes kotlin-build-tools-impl to resolve to 2.4.20-Beta1 instead of 2.4.0

Tools. Gradle. JS

• KT-87304 jsBrowserTest fails with "exited with errors (exit code: 1)"
• KT-86057 kotlinUpgradeYarnLock skips lock file regeneration when kotlinNpmInstall is up-to-date, causing kotlinStoreYarnLock to fail

Tools. Gradle. Multiplatform

• KT-87084 False positive warning for JS and Wasm compilations when CRI is enabled

Tools. Scripts

• KT-87076 @file:CompilerOptions("-jvm-target", ...) ignored in .main.kts scripts in Kotlin 2.4.0, falling back to JVM target 1.8
• KT-86352 K2 scripting: FirResolvedTypeRef exception when resolving extension functions from imported scripts

Commits

• 5687445 Add Changelog for 2.4.10-RC2
• ba30392 [Wasm] Support regenerate unchanged modules flag on KGP
• 6307e73 [Wasm] Implement Xwasm-IC-generate-unchanged-modules flag
• 39d7aee Add ChangeLog for 2.4.10-RC2
• a2956be [Gradle] Update karma.conf.js to use 'require(...)' instead plain strings
• 9b1361c [Gradle] KT-87223: Updated regression test
• a4c153a [Gradle] KT-87223: Fix toochain to 2.4.0 for abiValidation compat config
• bc04b90 Add ChangeLog for 2.4.10-RC
• bbcb94b [CRI] explicitly disable CRI generation for non-JVM targets to avoid false-po...
• 6c2c458 Scripting: fix jvmTarget processing from script annotations
• Additional commits viewable in compare view

Updates io.github.darkryh.katalyst:katalyst-conventions from 1.0.0-alpha02 to 1.0.0-alpha05

Release notes

Sourced from io.github.darkryh.katalyst:katalyst-conventions's releases.

1.0.0-alpha04

What's Changed

• feat(initializr): simple-first redesign with real vector icons by @​darkryh in darkryh/katalyst#15

Full Changelog: v1.0.0-alpha03...v1.0.0-alpha04

1.0.0-alpha03

Drop-in from 1.0.0-alpha02 — additive changes and a metadata fix, no breaking changes.

Added

• katalyst-starter-observability — one dependency line adds the bounded in-process telemetry layer and the embedded TUI inspector to an app. It's kept out of katalyst-starter-core on purpose: telemetry's capturers reach into persistence, transactions, migrations, scheduler, events and Ktor, so folding it into core would force those modules onto every app's classpath regardless of the starters it chose. Add it explicitly when you want observability.
• katalyst-tui is now on Maven Central. The terminal inspector was previously resolvable only through a composite build or mavenLocal; external consumers can now depend on it directly. It's also the prerequisite for the observability starter above.
• Katalyst Initializr — a browser-based project generator. Pick a package, an engine and the feature starters you want, and download a ready-to-run service — generated entirely in the browser, no backend. Live at https://darkryh.github.io/katalyst/new/ with this release. (Tooling, not a dependency.)

Fixed

• Every published artifact's POM <name> and <description> now carry the real module name. $name inside the pom { } block was resolving to Maven's own unset name property instead of the project name, so artifacts — the BOM included — shipped with <name>Katalyst - property 'name'</name>. Metadata only, no code change, but it's what shows on Maven Central and in dependency insight.

Full changelog: v1.0.0-alpha02...v1.0.0-alpha03

Commits

• 615a1a3 chore(release): bump library to 1.0.0-alpha05
• 737f0d0 fix(di): discover lifecycle hooks without a Component/Service marker
• da2c8d9 ci(release-library): add dry-run mode for safe validation
• 3631682 chore(intellij-plugin): 0.3.0 change-notes
• 3fdaddd ci: add Maven Central publish workflow for the library
• 4179535 chore(release): bump library to 1.0.0-alpha04
• 1ab55b6 refactor(v1): hardening cleanup across all modules
• 14f78e4 chore: remove outdated katalyst skill
• b3041da build(samples): standalone consumer setup + validate-samples.sh
• cf4dd85 docs(v1): reconcile docs, AGENTS.md and README to actual source
• Additional commits viewable in compare view

Updates org.jetbrains.intellij.platform from 2.6.0 to 2.18.1

Updates io.ktor:ktor-server-core from 3.5.0 to 3.5.1

Release notes

Sourced from io.ktor:ktor-server-core's releases.

3.5.1

Published 25 June 2026

Improvements

• KTOR-9492 OpenAPI plugin: handle requireXxx functions in compiler plugin
• KTOR-9569 Add more details for KDoc of BearerAuthConfig.sendWithoutRequest
• KTOR-9571 Add KDoc for BearerAuthConfig.realm
• KTOR-9570 Add Kdoc for BearerAuthConfig.refreshTokens

Bugfixes

• KTOR-9646 Fix Kotlin 2.4.0 compiler plugin breaking changes
• KTOR-9585 OpenAPI: JsonSchema title is truncated when it contains a dot
• KTOR-9591 OpenAPI: @JsonClassDiscriminator on sealed types is ignored when generating OpenAPI discriminator schema
• KTOR-9597 OpenAPI: Schema name collisions because@SerialName of sealed subtypes is used as components.schemas key
• KTOR-9601 OpenAPI: nullable @​JvmInline value class loses nullability in generated schema
• KTOR-9620 Some issues related to digest authentication in 3.5.0
• KTOR-9623 Digest Auth: server must respond with one WWW-Authenticate header for each supported algorithm
• KTOR-9624 Digest Auth: "Unsupported charset in digest authentication header" for a charset name in lowercase
• KTOR-9630 Digest Auth: The plugin sends incorrect nonce when server responds with multiple WWW-Authenticate headers
• KTOR-9565 WebRTC: Peer stops receiving messages after a while on iOS
• KTOR-9610 WebRtcPeerConnection::close causes ClosedReceiveChannelException for other peer
• KTOR-9633 WebRTC statistics fetching race condition
• KTOR-9603 Structured concurrency is violated in WebRTC tests
• KTOR-9671 Darwin: Semicolons in URL path are sanitized
• KTOR-9639 Darwin: WebSocket client crashes the process when a PONG arrives after the session is closed
• KTOR-9575 Darwin: findCharset("UTF-16") maps to NSUTF16LittleEndianStringEncoding causing decoding failure for UTF-16 content with BOM
• KTOR-9661 HttpCache: InvalidCacheStateException is thrown on 304 when no cached entry matches varyKeys
• KTOR-9673 Caching always missing with Content Negotiation
• KTOR-9596 HttpTimeout: HttpRequestTimeoutException on any request with runTest and request timeout defined since 3.5.0
• KTOR-9632 HttpRequestBuilder.timeout call removes capabilities set in DefaultRequest
• KTOR-9252 ContentEncoding: Incomplete gzip response causes client/server to hang indefinitely
• KTOR-9670 Compression: The plugin ignores Accept-Encoding q=0 and most-specific matching
• KTOR-9614 Zstd Compression: "Destination buffer is too small" exception for a particular sequence of bytes
• KTOR-9636 CORS plugin drops OPTIONS preflight requests when allowSameOrigin is on
• KTOR-9659 CORS is skipped when the Origin header contains an IPv6 address
• KTOR-9574 ContentNegotiation: The charset of Accept-Charset header is used for response deserialization
• KTOR-9606 KotlinxSerializationConverter: it fails to deserialize an empty channel closed with a delay
• KTOR-9617 OutputStreamContent and WriterContent can exhaust Dispatchers.IO
• KTOR-9629 RawSourceChannel: coroutine cancellation is not propagated to the RawSource
• KTOR-8870 File.readChannel: do not close a non-opened file and ignore closing exceptions
• KTOR-9460 Curl: Can't build shared library with Ktor 3.4.2
• KTOR-9607 Crash on Android 7: NoSuchMethodError getInstanceStrong() since 3.5.0
• KTOR-9595 CIO: The engine imports node:net statically and breaks wasmJsBrowser webpack build
• KTOR-9615 Apache5: The underlying request is not aborted when coroutine Job is cancelled
• KTOR-8443 RoutingBuilder.contentType does not use parameters when matching
• KTOR-9425 SessionTransportTransformerEncrypt init block uses wrong IV size for AES-256 (regression of KTOR-661)
• KTOR-9621 RateLimit plugin is bypassed when the nested authenticate block rejects the request
• KTOR-8766 DI: The close method is called twice on cleanup of AutoCloseable
• KTOR-8695 GMTDate() being offset by 369 years on Windows
• KTOR-9589 Duplicate PROPERTY_SETTER target in @InternalAPI annotation

... (truncated)

Changelog

Sourced from io.ktor:ktor-server-core's changelog.

3.5.1

Published 25 June 2026

Improvements

• KTOR-9492 OpenAPI plugin: handle requireXxx functions in compiler plugin
• KTOR-9569 Add more details for KDoc of BearerAuthConfig.sendWithoutRequest
• KTOR-9571 Add KDoc for BearerAuthConfig.realm
• KTOR-9570 Add Kdoc for BearerAuthConfig.refreshTokens

Bugfixes

• KTOR-9646 Fix Kotlin 2.4.0 compiler plugin breaking changes
• KTOR-9585 OpenAPI: JsonSchema title is truncated when it contains a dot
• KTOR-9591 OpenAPI: @JsonClassDiscriminator on sealed types is ignored when generating OpenAPI discriminator schema
• KTOR-9597 OpenAPI: Schema name collisions because@SerialName of sealed subtypes is used as components.schemas key
• KTOR-9601 OpenAPI: nullable @​JvmInline value class loses nullability in generated schema
• KTOR-9620 Some issues related to digest authentication in 3.5.0
• KTOR-9623 Digest Auth: server must respond with one WWW-Authenticate header for each supported algorithm
• KTOR-9624 Digest Auth: "Unsupported charset in digest authentication header" for a charset name in lowercase
• KTOR-9630 Digest Auth: The plugin sends incorrect nonce when server responds with multiple WWW-Authenticate headers
• KTOR-9565 WebRTC: Peer stops receiving messages after a while on iOS
• KTOR-9610 WebRtcPeerConnection::close causes ClosedReceiveChannelException for other peer
• KTOR-9633 WebRTC statistics fetching race condition
• KTOR-9603 Structured concurrency is violated in WebRTC tests
• KTOR-9671 Darwin: Semicolons in URL path are sanitized
• KTOR-9639 Darwin: WebSocket client crashes the process when a PONG arrives after the session is closed
• KTOR-9575 Darwin: findCharset("UTF-16") maps to NSUTF16LittleEndianStringEncoding causing decoding failure for UTF-16 content with BOM
• KTOR-9661 HttpCache: InvalidCacheStateException is thrown on 304 when no cached entry matches varyKeys
• KTOR-9673 Caching always missing with Content Negotiation
• KTOR-9596 HttpTimeout: HttpRequestTimeoutException on any request with runTest and request timeout defined since 3.5.0
• KTOR-9632 HttpRequestBuilder.timeout call removes capabilities set in DefaultRequest
• KTOR-9252 ContentEncoding: Incomplete gzip response causes client/server to hang indefinitely
• KTOR-9670 Compression: The plugin ignores Accept-Encoding q=0 and most-specific matching
• KTOR-9614 Zstd Compression: "Destination buffer is too small" exception for a particular sequence of bytes
• KTOR-9636 CORS plugin drops OPTIONS preflight requests when allowSameOrigin is on
• KTOR-9659 CORS is skipped when the Origin header contains an IPv6 address
• KTOR-9574 ContentNegotiation: The charset of Accept-Charset header is used for response deserialization
• KTOR-9606 KotlinxSerializationConverter: it fails to deserialize an empty channel closed with a delay
• KTOR-9617 OutputStreamContent and WriterContent can exhaust Dispatchers.IO
• KTOR-9629 RawSourceChannel: coroutine cancellation is not propagated to the RawSource
• KTOR-8870 File.readChannel: do not close a non-opened file and ignore closing exceptions
• KTOR-9460 Curl: Can't build shared library with Ktor 3.4.2
• KTOR-9607 Crash on Android 7: NoSuchMethodError getInstanceStrong() since 3.5.0
• KTOR-9595 CIO: The engine imports node:net statically and breaks wasmJsBrowser webpack build
• KTOR-9615 Apache5: The underlying request is not aborted when coroutine Job is cancelled
• KTOR-8443 RoutingBuilder.contentType does not use parameters when matching
• KTOR-9425 SessionTransportTransformerEncrypt init block uses wrong IV size for AES-256 (regression of KTOR-661)
• KTOR-9621 RateLimit plugin is bypassed when the nested authenticate block rejects the request
• KTOR-8766 DI: The close method is called twice on cleanup of AutoCloseable
• KTOR-8695 GMTDate() being offset by 369 years on Windows
• KTOR-9589 Duplicate PROPERTY_SETTER target in @​InternalAPI annotation

... (truncated)

Commits

• 5ba9d6f Release 3.5.1 (#5719)
• a4f145d KTOR-9661 HttpCache: InvalidCacheStateException is thrown on 304 when… (#5701)
• 2caf278 Fix failing :ktor-io:compileDarwinMainKotlinMetadata (#5716)
• 257de90 KTOR-8766 Fix multiple invocations of close from DI
• e77a168 Fix cache misses with content negotiation 3x (#5714)
• ed22950 Make huge post test less huge
• f329069 Update dependency com.github.luben:zstd-jni to v1.5.7-11
• 6ecd072 Update dependency io.swagger.parser.v3:swagger-parser to v2.1.44
• a0534cd Update dependency io.pebbletemplates:pebble to v4.1.2
• 8647e53 Update dependency com.typesafe:config to v1.4.9
• Additional commits viewable in compare view

Updates io.ktor:ktor-server-content-negotiation from 3.5.0 to 3.5.1

Release notes

Sourced from io.ktor:ktor-server-content-negotiation's releases.

3.5.1

Published 25 June 2026

Improvements

• KTOR-9492 OpenAPI plugin: handle requireXxx functions in compiler plugin
• KTOR-9569 Add more details for KDoc of BearerAuthConfig.sendWithoutRequest
• KTOR-9571 Add KDoc for BearerAuthConfig.realm
• KTOR-9570 Add Kdoc for BearerAuthConfig.refreshTokens

Bugfixes

• KTOR-9646 Fix Kotlin 2.4.0 compiler plugin breaking changes
• KTOR-9585 OpenAPI: JsonSchema title is truncated when it contains a dot
• KTOR-9591 OpenAPI: @JsonClassDiscriminator on sealed types is ignored when generating OpenAPI discriminator schema
• KTOR-9597 OpenAPI: Schema name collisions because@SerialName of sealed subtypes is used as components.schemas key
• KTOR-9601 OpenAPI: nullable @​JvmInline value class loses nullability in generated schema
• KTOR-9620 Some issues related to digest authentication in 3.5.0
• KTOR-9623 Digest Auth: server must respond with one WWW-Authenticate header for each supported algorithm
• KTOR-9624 Digest Auth: "Unsupported charset in digest authentication header" for a charset name in lowercase
• KTOR-9630 Digest Auth: The plugin sends incorrect nonce when server responds with multiple WWW-Authenticate headers
• KTOR-9565 WebRTC: Peer stops receiving messages after a while on iOS
• KTOR-9610 WebRtcPeerConnection::close causes ClosedReceiveChannelException for other peer
• KTOR-9633 WebRTC statistics fetching race condition
• KTOR-9603 Structured concurrency is violated in WebRTC tests
• KTOR-9671 Darwin: Semicolons in URL path are sanitized
• KTOR-9639 Darwin: WebSocket client crashes the process when a PONG arrives after the session is closed
• KTOR-9575 Darwin: findCharset("UTF-16") maps to NSUTF16LittleEndianStringEncoding causing decoding failure for UTF-16 content with BOM
• KTOR-9661 HttpCache: InvalidCacheStateException is thrown on 304 when no cached entry matches varyKeys
• KTOR-9673 Caching always missing with Content Negotiation
• KTOR-9596 HttpTimeout: HttpRequestTimeoutException on any request with runTest and request timeout defined since 3.5.0
• KTOR-9632 HttpRequestBuilder.timeout call removes capabilities set in DefaultRequest
• KTOR-9252 ContentEncoding: Incomplete gzip response causes client/server to hang indefinitely
• KTOR-9670 Compression: The plugin ignores Accept-Encoding q=0 and most-specific matching
• KTOR-9614 Zstd Compression: "Destination buffer is too small" exception for a particular sequence of bytes
• KTOR-9636 CORS plugin drops OPTIONS preflight requests when allowSameOrigin is on
• KTOR-9659 CORS is skipped when the Origin header contains an IPv6 address
• KTOR-9574 ContentNegotiation: The charset of Accept-Charset header is used for response deserialization
• KTOR-9606 KotlinxSerializationConverter: it fails to deserialize an empty channel closed with a delay
• KTOR-9617 OutputStreamContent and WriterContent can exhaust Dispatchers.IO
• KTOR-9629 RawSourceChannel: coroutine cancellation is not propagated to the RawSource
• KTOR-8870 File.readChannel: do not close a non-opened file and ignore closing exceptions
• KTOR-9460 Curl: Can't build shared library with Ktor 3.4.2
• KTOR-9607 Crash on Android 7: NoSuchMethodError getInstanceStrong() since 3.5.0
• KTOR-9595 CIO: The engine imports node:net statically and breaks wasmJsBrowser webpack build
• KTOR-9615 Apache5: The underlying request is not aborted when coroutine Job is cancelled
• KTOR-8443 RoutingBuilder.contentType does not use parameters when matching
• KTOR-9425 SessionTransportTransformerEncrypt init block uses wrong IV size for AES-256 (regression of KTOR-661)
• KTOR-9621 RateLimit plugin is bypassed when the nested authenticate block rejects the request
• KTOR-8766 DI: The close method is called twice on cleanup of AutoCloseable
• KTOR-8695 GMTDate() being offset by 369 years on Windows
• KTOR-9589 Duplicate PROPERTY_SETTER target in @InternalAPI annotation

... (truncated)

Changelog

Sourced from io.ktor:ktor-server-content-negotiation's changelog.

3.5.1

Published 25 June 2026

Improvements

• KTOR-9492 OpenAPI plugin: handle requireXxx functions in compiler plugin
• KTOR-9569 Add more details for KDoc of BearerAuthConfig.sendWithoutRequest
• KTOR-9571 Add KDoc for BearerAuthConfig.realm
• KTOR-9570 Add Kdoc for BearerAuthConfig.refreshTokens

Bugfixes

• KTOR-9646 Fix Kotlin 2.4.0 compiler plugin breaking changes
• KTOR-9585 OpenAPI: JsonSchema title is truncated when it contains a dot
• KTOR-9591 OpenAPI: @JsonClassDiscriminator on sealed types is ignored when generating OpenAPI discriminator schema
• KTOR-9597 OpenAPI: Schema name collisions because@SerialName of sealed subtypes is used as components.schemas key
• KTOR-9601 OpenAPI: nullable @​JvmInline value class loses nullability in generated schema
• KTOR-9620 Some issues related to digest authentication in 3.5.0
• KTOR-9623 Digest Auth: server must respond with one WWW-Authenticate header for each supported algorithm
• KTOR-9624 Digest Auth: "Unsupported charset in digest authentication header" for a charset name in lowercase
• KTOR-9630 Digest Auth: The plugin sends incorrect nonce when server responds with multiple WWW-Authenticate headers
• KTOR-9565 WebRTC: Peer stops receiving messages after a while on iOS
• KTOR-9610 WebRtcPeerConnection::close causes ClosedReceiveChannelException for other peer
• KTOR-9633 WebRTC statistics fetching race condition
• KTOR-9603 Structured concurrency is violated in WebRTC tests
• KTOR-9671 Darwin: Semicolons in URL path are sanitized
• KTOR-9639 Darwin: WebSocket client crashes the process when a PONG arrives after the session is closed
• KTOR-9575 Darwin: findCharset("UTF-16") maps to NSUTF16LittleEndianStringEncoding causing decoding failure for UTF-16 content with BOM
• KTOR-9661 HttpCache: InvalidCacheStateException is thrown on 304 when no cached entry matches varyKeys
• KTOR-9673 Caching always missing with Content Negotiation
• KTOR-9596 HttpTimeout: HttpRequestTimeoutException on any request with runTest and request timeout defined since 3.5.0
• KTOR-9632 HttpRequestBuilder.timeout call removes capabilities set in DefaultRequest
• KTOR-9252 ContentEncoding: Incomplete gzip response causes client/server to hang indefinitely
• KTOR-9670 Compression: The plugin ignores Accept-Encoding q=0 and most-specific matching
• KTOR-9614 Zstd Compression: "Destination buffer is too small" exception for a particular sequence of bytes
• KTOR-9636 CORS plugin drops OPTIONS preflight requests when allowSameOrigin is on
• KTOR-9659 CORS is skipped when the Origin header contains an IPv6 address
• KTOR-9574 ContentNegotiation: The charset of Accept-Charset header is used for response deserialization
• KTOR-9606 KotlinxSerializationConverter: it fails to deserialize an empty channel closed with a delay
• KTOR-9617 OutputStreamContent and WriterContent can exhaust Dispatchers.IO
• KTOR-9629 RawSourceChannel: coroutine cancellation is not propagated to the RawSource
• KTOR-8870 File.readChannel: do not close a non-opened file and ignore closing exceptions
• KTOR-9460 Curl: Can't build shared library with Ktor 3.4.2
• KTOR-9607 Crash on Android 7: NoSuchMethodError getInstanceStrong() since 3.5.0
• KTOR-9595 CIO: The engine imports node:net statically and breaks wasmJsBrowser webpack build
• KTOR-9615 Apache5: The underlying request is not aborted when coroutine Job is cancelled
• KTOR-8443 RoutingBuilder.contentType does not use parameters when matching
• KTOR-9425 SessionTransportTransformerEncrypt init block uses wrong IV size for AES-256 (regression of KTOR-661)
• KTOR-9621 RateLimit plugin is bypassed when the nested authenticate block rejects the request
• KTOR-8766 DI: The close method is called twice on cleanup of AutoCloseable
• KTOR-8695 GMTDate() being offset by 369 years on Windows
• KTOR-9589 Duplicate PROPERTY_SETTER target in @​InternalAPI annotation

... (truncated)

Commits

• 5ba9d6f Release 3.5.1 (#5719)
• a4f145d KTOR-9661 HttpCache: InvalidCacheStateException is thrown on 304 when… (#5701)
• 2caf278 Fix failing :ktor-io:compileDarwinMainKotlinMetadata (#5716)
• 257de90 KTOR-8766 Fix multiple invocations of close from DI
• e77a168 Fix cache misses with content negotiation 3x (#5714)
• ed22950 Make huge post test less huge
• f329069 Update dependency com.github.luben:zstd-jni to v1.5.7-11
• 6ecd072 Update dependency io.swagger.parser.v3:swagger-parser to v2.1.44
• a0534cd Update dependency io.pebbletemplates:pebble to v4.1.2
• 8647e53 Update dependency com.typesafe:config to v1.4.9
• Additional commits viewable in compare view

Updates io.ktor:ktor-server-auth from 3.5.0 to 3.5.1

Release notes

Sourced from io.ktor:ktor-server-a...

Description has been truncated