deps: bump the library-dependencies group across 1 directory with 27 updates

[dependabot]

Bumps the library-dependencies group with 27 updates in the / directory:

Package	From	To
jvm	2.4.10	2.4.20
io.ktor.plugin	3.5.2	3.6.0
io.github.darkryh.katalyst:katalyst-conventions	1.0.0-alpha02	1.0.0-beta05
org.jetbrains.intellij.platform	2.18.1	2.19.0
io.ktor:ktor-server-core	3.5.2	3.6.0
io.ktor:ktor-server-content-negotiation	3.5.2	3.6.0
io.ktor:ktor-server-auth	3.5.2	3.6.0
io.ktor:ktor-server-auth-jwt	3.5.2	3.6.0
io.ktor:ktor-server-status-pages	3.5.2	3.6.0
io.ktor:ktor-server-websockets	3.5.2	3.6.0
io.ktor:ktor-server-call-id	3.5.2	3.6.0
io.ktor:ktor-server-rate-limit	3.5.2	3.6.0
io.ktor:ktor-serialization-kotlinx-json	3.5.2	3.6.0
io.ktor:ktor-server-test-host	3.5.2	3.6.0
io.ktor:ktor-server-host-common	3.5.2	3.6.0
io.ktor:ktor-server-netty	3.5.2	3.6.0
io.ktor:ktor-server-cio	3.5.2	3.6.0
io.ktor:ktor-server-jetty-jakarta	3.5.2	3.6.0
io.ktor:ktor-server-config-yaml	3.5.2	3.6.0
io.ktor:ktor-client-websockets	3.5.2	3.6.0
io.ktor:ktor-client-core	3.5.2	3.6.0
io.ktor:ktor-client-cio	3.5.2	3.6.0
io.ktor:ktor-server-content-negotiation	3.5.2	3.6.0
io.ktor:ktor-server-auth	3.5.2	3.6.0
io.ktor:ktor-server-auth-jwt	3.5.2	3.6.0
io.ktor:ktor-server-status-pages	3.5.2	3.6.0
io.ktor:ktor-server-websockets	3.5.2	3.6.0
io.ktor:ktor-server-call-id	3.5.2	3.6.0
io.ktor:ktor-server-rate-limit	3.5.2	3.6.0
io.ktor:ktor-serialization-kotlinx-json	3.5.2	3.6.0
io.ktor:ktor-server-test-host	3.5.2	3.6.0
io.ktor:ktor-server-host-common	3.5.2	3.6.0
io.ktor:ktor-server-netty	3.5.2	3.6.0
io.ktor:ktor-server-cio	3.5.2	3.6.0
io.ktor:ktor-server-jetty-jakarta	3.5.2	3.6.0
io.ktor:ktor-server-config-yaml	3.5.2	3.6.0
io.ktor:ktor-client-websockets	3.5.2	3.6.0
io.ktor:ktor-client-core	3.5.2	3.6.0
io.ktor:ktor-client-cio	3.5.2	3.6.0
com.h2database:h2	2.4.240	2.5.252
ch.qos.logback:logback-classic	1.6.1	1.6.4
org.slf4j:slf4j-api	2.0.17	2.0.20
dev.kourier:amqp-client-robust-jvm	0.4.6	0.5.0
org.yaml:snakeyaml	2.6	2.7

Updates jvm from 2.4.10 to 2.4.20

Release notes

Sourced from jvm's releases.

Kotlin 2.4.20

Changelog

Analysis API

• KT-86546 Check suspicious when over ConeKotlinType in ConeTypeCompatibilityChecker
• KT-85418 Implement an API for accessing deserialized file annotations in Analysis API
• KT-74448 K2. False positive MISSING_DEPENDENCY_SUPERCLASS in LinkedListTest.kt, kotlinx.coroutines
• KT-85856 containingSymbol of constructor property differs for local and non-local classes
• KT-65417 K2 IDE: KTOR false positive expect-actual matching error on enum class because of implicit clone() in non-JVM source sets

Analysis API. Code Compilation

• KT-76457 K2 IDE / KMP Debugger: KISEWA “Cannot compile a common source without a JVM counterpart” on evaluating inline fun from common module inside jvm

Analysis API. FIR

• KT-70552 No expects for actual
• KT-69727 K2 IDE. Wrong error in the editor on calling clone function of actual enum instance in non-jvm platform
• KT-69726 FP errors on declaring fun clone() in actual enum in not-jvm source-set
• KT-86014 Types are broken after remove parameter through change signature
• KT-86363 KotlinIllegalArgumentExceptionWithAttachments: No dangling modifier found on companion blocks
• KT-86147 Drop kotlin.parallel.resolve.under.global.lock registry key
• KT-85543 Avoid lazy resolve for the contracts phase if no constracts might be resolved

Analysis API. Infrastructure

• KT-84914 Do not publish analysis-api-test-framework
• KT-86986 kotlin-compiler-common-for-ide bundles unrelated Analysis API modules
• KT-86186 Analysis API: Codebase tests run twice in some analysis modules — pick a single JUnit runner and migrate
• KT-85360 Drop kotlin-compiler-testdata-for-ide artifact
• KT-85585 Simplify the dependencies graph for the Analysis API modules
• KT-85381 Remove tests for the FE10 implementation

Analysis API. Light Classes

New Features

• KT-84645 Support resolving to companion block members & extensions from Java (light classes)
• KT-80775 Support PsiClass#getRecordComponents in light classes

Fixes

• KT-57537 SLC: propagate default parameter value from (@JvmOverloads) expect declarations to actual declarations
• KT-85040 [Analysis API] Improve Java / Kotlin interop in KMP projects
• KT-87301 SymbolLightAccessorMethod#isValid returns false for delegated properties
• KT-87171 SLC: non-mapped Kotlin collection supertype is dropped from supertype list
• KT-87250 JvmExposeBoxed: light classes shouldn't be autogenerated for private declarations
• KT-70428 AA: good code is red when a Java class extends a Kotlin class implementing MutableList by delegation
• KT-63568 Symbol Light Classes: KtAnnotationApplicationWithArgumentsInfo.normalizedArguments() may work incorrectly when psi is not set

... (truncated)

Changelog

Sourced from jvm's changelog.

2.4.20

Analysis API

• KT-86546 Check suspicious when over ConeKotlinType in ConeTypeCompatibilityChecker
• KT-85418 Implement an API for accessing deserialized file annotations in Analysis API
• KT-74448 K2. False positive MISSING_DEPENDENCY_SUPERCLASS in LinkedListTest.kt, kotlinx.coroutines
• KT-85856 containingSymbol of constructor property differs for local and non-local classes
• KT-65417 K2 IDE: KTOR false positive expect-actual matching error on enum class because of implicit clone() in non-JVM source sets

Analysis API. Code Compilation

• KT-76457 K2 IDE / KMP Debugger: KISEWA “Cannot compile a common source without a JVM counterpart” on evaluating inline fun from common module inside jvm

Analysis API. FIR

• KT-70552 No expects for actual
• KT-69727 K2 IDE. Wrong error in the editor on calling clone function of actual enum instance in non-jvm platform
• KT-69726 FP errors on declaring fun clone() in actual enum in not-jvm source-set
• KT-86014 Types are broken after remove parameter through change signature
• KT-86363 KotlinIllegalArgumentExceptionWithAttachments: No dangling modifier found on companion blocks
• KT-86147 Drop kotlin.parallel.resolve.under.global.lock registry key
• KT-85543 Avoid lazy resolve for the contracts phase if no constracts might be resolved

Analysis API. Infrastructure

• KT-84914 Do not publish analysis-api-test-framework
• KT-86986 kotlin-compiler-common-for-ide bundles unrelated Analysis API modules
• KT-86186 Analysis API: Codebase tests run twice in some analysis modules — pick a single JUnit runner and migrate
• KT-85360 Drop kotlin-compiler-testdata-for-ide artifact
• KT-85585 Simplify the dependencies graph for the Analysis API modules
• KT-85381 Remove tests for the FE10 implementation

Analysis API. Light Classes

New Features

• KT-84645 Support resolving to companion block members & extensions from Java (light classes)
• KT-80775 Support PsiClass#getRecordComponents in light classes

Fixes

• KT-57537 SLC: propagate default parameter value from (@JvmOverloads) expect declarations to actual declarations
• KT-85040 [Analysis API] Improve Java / Kotlin interop in KMP projects
• KT-87301 SymbolLightAccessorMethod#isValid returns false for delegated properties
• KT-87171 SLC: non-mapped Kotlin collection supertype is dropped from supertype list
• KT-87250 JvmExposeBoxed: light classes shouldn't be autogenerated for private declarations
• KT-70428 AA: good code is red when a Java class extends a Kotlin class implementing MutableList by delegation
• KT-63568 Symbol Light Classes: KtAnnotationApplicationWithArgumentsInfo.normalizedArguments() may work incorrectly when psi is not set
• KT-36740 MPP: False-positive incompatible types in .java when using expect-class returned by non-expect member from common when actual is actual typealias

... (truncated)

Commits

• 890ac1d Add Changelog for 2.4.20-RC3
• 8860aed 🍒 [FIR] Fix suspend conversion when expected type is nullable (#7769)
• ab5bcd9 Edit ChangeLog for 2.4.20-RC2
• 9464edc Add ChangeLog for 2.4.20-RC2
• 0261e43 Cherry-pick "Fix asBodyAndResultVar call in `visitInlinedLambdaInComposable...
• 0763513 [box-tests] Workaround for klib compatibility tests (#7626)
• 045aec6 [Wasm] Append scripts from webpack.config.d in the end of the file (#7615)
• cd7173b 🍒 [2.4.20] [K/JS] Keep associated obj annotation only if getInstance survives...
• d36a2ff CastsOptimizationPass: break aliases cycles (#7578)
• 8664983 [CLI] Restore custom IC search scope creation
• Additional commits viewable in compare view

Updates io.ktor.plugin from 3.5.2 to 3.6.0

Updates io.github.darkryh.katalyst:katalyst-conventions from 1.0.0-alpha02 to 1.0.0-beta05

Release notes

Sourced from io.github.darkryh.katalyst:katalyst-conventions's releases.

1.0.0-beta05

A single-defect release. The terminal inspector's Migrations screen could report a perfectly healthy, successfully applied migration as an orphaned database-only row — but only if you attached to it early enough. That is fixed, along with the reporting weaknesses that stood behind it.

dependencies {
    implementation(platform("io.github.darkryh.katalyst:katalyst-bom:1.0.0-beta05"))
}

The fix

An applied migration is no longer reported as orphaned while the application is still booting (#36). TelemetryFeature.provideBeanModules() installs the capturers and starts the telemetry server while feature bean modules are still being prepared — which is before component discovery has registered the application's KatalystMigration classes. The transport was therefore reachable during a window in which getAll<KatalystMigration>() returns an empty or partial set.

An inspector attaching in that window made the capturer reconcile the migration history against that incomplete set, and the only conclusion available from such a comparison is that the row exists in the database and nowhere else. The screen said so, in the most alarming way it knows how: state unknown!, checksum db present, checksum code —, unknownApplied = 1. It reads exactly like a migration that was applied and then deleted from the application. The one-minute status cache then held that verdict long after discovery had finished, so the screen kept reporting it for up to a minute after there was anything left to get wrong.

MigrationCapturer now waits for the component-discovery lifecycle to report COMPLETED before it reconciles anything at all. Until then the snapshot carries statusReady = false and the screen says so — "Source migrations are still being registered" — and the incomplete view is never cached. The transport stays live throughout and every other subsystem keeps streaming normally.

Worth stating plainly: nothing about migration execution was ever wrong here. No migration ran twice, no checksum was miscomputed, no history row was mis-written. This was a reporting race from end to end, and the fix is entirely in what the inspector is willing to claim and when.

What else moved with it

Applied migrations appear immediately instead of up to a minute later. The status cache is now keyed by the runner's committed-history revision as well as by time. A revision change bypasses the TTL at once; a stable revision keeps the one-JDBC-read-per-minute bound that the cache exists for. If the revision changes during a read, the read is repeated once — so a stale result can never be stamped with a fresh coherency token.

A drifting migration finally shows the two checksums that differ. MigrationStatus carried one checksum field whose meaning depended on the row's state, and the capturer re-derived which one it was holding from that state. It now carries checksumDb and checksumCode as two distinct values all the way down to the screen.

An unreadable history table is reported as unreadable. status() used to swallow an unavailable

... (truncated)

Commits

• e25f45d chore(release): cut 1.0.0-beta05
• d55d650 fix(telemetry,tui): make migration status lifecycle-aware
• d87728e chore(release): cut 1.0.0-beta04
• a12e8a8 test(persistence): drive the quiesce wait off the connection, not the clock
• 6fd256b test(di): wait for the worker to poll instead of sleeping for it
• a3f9b38 docs: document the shutdown phase
• 45c5bb4 fix(di): tear Katalyst down after the application's own stop handlers
• 8002e5d feat(di): give the application a shutdown lifecycle
• a2e8e4e feat(persistence): let the connection pool go quiet before it closes
• fd9c836 chore(release): cut 1.0.0-beta03
• Additional commits viewable in compare view

Updates org.jetbrains.intellij.platform from 2.18.1 to 2.19.0

Updates io.ktor:ktor-server-core from 3.5.2 to 3.6.0

Release notes

Sourced from io.ktor:ktor-server-core's releases.

3.6.0

Published 16 September 2026

Features

• KTOR-8596 OpenID Connect (OAuth2) auto-discover & configuration
• KTOR-9645 Client curated multi-platform facade module
• KTOR-8883 Support nested jars in static resources
• KTOR-8672 Support at least zstd and deflate formats of precompressed files
• KTOR-8595 Auth JWK Support (auto-discover)
• KTOR-9841 OIDC Server Plugin
• KTOR-9654 Override fetch in JS engine
• KTOR-9785 Typesafe Authentication DSL
• KTOR-462 Async CIO DNS resolver with timeout
• KTOR-9709 Add resource attribute for client resources plugin
• KTOR-5009 ContentNegotiation: Add a way to prevent changing Accept and Content-Type headers
• KTOR-9776 OpenAPI: Support the "const" validation keyword
• KTOR-7468 DefaultConversionService: Support Uuid type introduced in Kotlin 2.0
• KTOR-9578 HttpCache add method for clearing
• KTOR-9590 OpenAPI Contextual JSON schema inference support
• KTOR-6610 Log which ConfigLoader has been used for loading the server configuration
• KTOR-9735 Commonize HttpCache FileCacheStorage
• KTOR-8953 WebRTC client on JVM
• KTOR-9674 UDP support for Node.js targets
• KTOR-9612 Add text/markdown to the ContentType constants

Improvements

• KTOR-9876 Typo in KDoc for routing function: "for the this Application".
• KTOR-9778 Character classification in ktor-http hot paths uses boxed Set lookups and per-symbol encoder allocations
• KTOR-9702 Duplicate code in ByteReadChannel
• KTOR-9716 Make ApplicationCallPipeline.ApplicationPhase.Validators public in 3.6.0
• KTOR-9734 Use TagConsumer in respondHtmlFragment lambda receiver
• KTOR-5577 Support nullable types in ApplicationCall.receive
• KTOR-2367 OAuth: clients expect to get authenticated once per "session" for all protected routes
• KTOR-8594 Auth: Non-optional principal is of nullable type
• KTOR-9816 Escape $ in application.yaml file
• KTOR-8193 Unnecessary blocking in OutputStream wrapper

Bugfixes

• KTOR-8705 testApplication: call coroutine context isn't preserved when responding with ChannelWriterContent
• KTOR-9248 JWTAuthenticationProvider silently swallows exceptions
• KTOR-9892 Digest Auth client: nc and qop are not handled according to RFC 7616
• KTOR-9891 CIO on Kotlin/Native collapses above ~50 connections: HttpHeadersMap pools contend on an allocating SynchronizedObject
• KTOR-9794 Digest Auth: NullPointerException when the server does not expect Digest auth
• KTOR-9788 Netty: engine double-responds after its built-in 400, crashing the call-handler coroutine with "Headers can no longer be set because response was already completed"
• KTOR-9834 HttpClient eagerly initializes SLF4J during Android startup
• KTOR-9701 Jackson/Gson converters waste time on unnecessary Dispatchers.IO dispatch
• KTOR-9832 Apache5: Upgrading Apache HttpClient5 to version 5.6 breaks the Ktor client with Content-Length mismatch error for any gzipped content
• KTOR-9870 OkHttp: Reduce coroutine dispatching and allocations while reading response bodies
• KTOR-9627 Cancel blocking bridges when coroutine is cancelled
• KTOR-7067 Ktor Cookie.parseClientCookiesHeader returns Map, which breaks Cookie header contract

... (truncated)

Changelog

Sourced from io.ktor:ktor-server-core's changelog.

3.6.0

Published 16 September 2026

Features

• KTOR-8596 OpenID Connect (OAuth2) auto-discover & configuration
• KTOR-9645 Client curated multi-platform facade module
• KTOR-8883 Support nested jars in static resources
• KTOR-8672 Support at least zstd and deflate formats of precompressed files
• KTOR-8595 Auth JWK Support (auto-discover)
• KTOR-9841 OIDC Server Plugin
• KTOR-9654 Override fetch in JS engine
• KTOR-9785 Typesafe Authentication DSL
• KTOR-462 Async CIO DNS resolver with timeout
• KTOR-9709 Add resource attribute for client resources plugin
• KTOR-5009 ContentNegotiation: Add a way to prevent changing Accept and Content-Type headers
• KTOR-9776 OpenAPI: Support the "const" validation keyword
• KTOR-7468 DefaultConversionService: Support Uuid type introduced in Kotlin 2.0
• KTOR-9578 HttpCache add method for clearing
• KTOR-9590 OpenAPI Contextual JSON schema inference support
• KTOR-6610 Log which ConfigLoader has been used for loading the server configuration
• KTOR-9735 Commonize HttpCache FileCacheStorage
• KTOR-8953 WebRTC client on JVM
• KTOR-9674 UDP support for Node.js targets
• KTOR-9612 Add text/markdown to the ContentType constants

Improvements

• KTOR-9876 Typo in KDoc for routing function: "for the this Application".
• KTOR-9778 Character classification in ktor-http hot paths uses boxed Set lookups and per-symbol encoder allocations
• KTOR-9702 Duplicate code in ByteReadChannel
• KTOR-9716 Make ApplicationCallPipeline.ApplicationPhase.Validators public in 3.6.0
• KTOR-9734 Use TagConsumer in respondHtmlFragment lambda receiver
• KTOR-5577 Support nullable types in ApplicationCall.receive
• KTOR-2367 OAuth: clients expect to get authenticated once per "session" for all protected routes
• KTOR-8594 Auth: Non-optional principal is of nullable type
• KTOR-9816 Escape $ in application.yaml file
• KTOR-8193 Unnecessary blocking in OutputStream wrapper

Bugfixes

• KTOR-8705 testApplication: call coroutine context isn't preserved when responding with ChannelWriterContent
• KTOR-9248 JWTAuthenticationProvider silently swallows exceptions
• KTOR-9892 Digest Auth client: nc and qop are not handled according to RFC 7616
• KTOR-9891 CIO on Kotlin/Native collapses above ~50 connections: HttpHeadersMap pools contend on an allocating SynchronizedObject
• KTOR-9794 Digest Auth: NullPointerException when the server does not expect Digest auth
• KTOR-9788 Netty: engine double-responds after its built-in 400, crashing the call-handler coroutine with "Headers can no longer be set because response was already completed"
• KTOR-9834 HttpClient eagerly initializes SLF4J during Android startup
• KTOR-9701 Jackson/Gson converters waste time on unnecessary Dispatchers.IO dispatch
• KTOR-9832 Apache5: Upgrading Apache HttpClient5 to version 5.6 breaks the Ktor client with Content-Length mismatch error for any gzipped content
• KTOR-9870 OkHttp: Reduce coroutine dispatching and allocations while reading response bodies
• KTOR-9627 Cancel blocking bridges when coroutine is cancelled
• KTOR-7067 Ktor Cookie.parseClientCookiesHeader returns Map, which breaks Cookie header contract

... (truncated)

Commits

• 111c580 Release 3.6.0 (#5882)
• 1e4186c KTOR-9876 Fix typo in Application.routing KDoc (#5876)
• 6930eee Fix KTOR-9892 Digest Auth client: nc and qop ... (#5875)
• 875b2f0 Fix KTOR-9794 Digest Auth: NullPointerException when the server does not expe...
• dc56137 KTOR-8705 Pass coroutine context to the channel writer (#5868)
• 55f6e71 Fix KTOR-9640 forward autoFlush in reader/writer helpers
• 2b04a1f Fix KTOR-9248 JWTAuthenticationProvider silently swallows exceptions (#5877)
• 702ff9f KTOR-9889 Fix deadlock in concurrent module loading with Dependency Injection...
• 1fab5f1 Reject Accept entries with q=0 in ContentNegotiation (#5873)
• b06c3b5 KTOR-9891 Delegate SynchronizedObject to kotlinx.atomicfu on Native (#5874)
• Additional commits viewable in compare view

Updates io.ktor:ktor-server-content-negotiation from 3.5.2 to 3.6.0

Release notes

Sourced from io.ktor:ktor-server-content-negotiation's releases.

3.6.0

Published 16 September 2026

Features

• KTOR-8596 OpenID Connect (OAuth2) auto-discover & configuration
• KTOR-9645 Client curated multi-platform facade module
• KTOR-8883 Support nested jars in static resources
• KTOR-8672 Support at least zstd and deflate formats of precompressed files
• KTOR-8595 Auth JWK Support (auto-discover)
• KTOR-9841 OIDC Server Plugin
• KTOR-9654 Override fetch in JS engine
• KTOR-9785 Typesafe Authentication DSL
• KTOR-462 Async CIO DNS resolver with timeout
• KTOR-9709 Add resource attribute for client resources plugin
• KTOR-5009 ContentNegotiation: Add a way to prevent changing Accept and Content-Type headers
• KTOR-9776 OpenAPI: Support the "const" validation keyword
• KTOR-7468 DefaultConversionService: Support Uuid type introduced in Kotlin 2.0
• KTOR-9578 HttpCache add method for clearing
• KTOR-9590 OpenAPI Contextual JSON schema inference support
• KTOR-6610 Log which ConfigLoader has been used for loading the server configuration
• KTOR-9735 Commonize HttpCache FileCacheStorage
• KTOR-8953 WebRTC client on JVM
• KTOR-9674 UDP support for Node.js targets
• KTOR-9612 Add text/markdown to the ContentType constants

Improvements

• KTOR-9876 Typo in KDoc for routing function: "for the this Application".
• KTOR-9778 Character classification in ktor-http hot paths uses boxed Set lookups and per-symbol encoder allocations
• KTOR-9702 Duplicate code in ByteReadChannel
• KTOR-9716 Make ApplicationCallPipeline.ApplicationPhase.Validators public in 3.6.0
• KTOR-9734 Use TagConsumer in respondHtmlFragment lambda receiver
• KTOR-5577 Support nullable types in ApplicationCall.receive
• KTOR-2367 OAuth: clients expect to get authenticated once per "session" for all protected routes
• KTOR-8594 Auth: Non-optional principal is of nullable type
• KTOR-9816 Escape $ in application.yaml file
• KTOR-8193 Unnecessary blocking in OutputStream wrapper

Bugfixes

• KTOR-8705 testApplication: call coroutine context isn't preserved when responding with ChannelWriterContent
• KTOR-9248 JWTAuthenticationProvider silently swallows exceptions
• KTOR-9892 Digest Auth client: nc and qop are not handled according to RFC 7616
• KTOR-9891 CIO on Kotlin/Native collapses above ~50 connections: HttpHeadersMap pools contend on an allocating SynchronizedObject
• KTOR-9794 Digest Auth: NullPointerException when the server does not expect Digest auth
• KTOR-9788 Netty: engine double-responds after its built-in 400, crashing the call-handler coroutine with "Headers can no longer be set because response was already completed"
• KTOR-9834 HttpClient eagerly initializes SLF4J during Android startup
• KTOR-9701 Jackson/Gson converters waste time on unnecessary Dispatchers.IO dispatch
• KTOR-9832 Apache5: Upgrading Apache HttpClient5 to version 5.6 breaks the Ktor client with Content-Length mismatch error for any gzipped content
• KTOR-9870 OkHttp: Reduce coroutine dispatching and allocations while reading response bodies
• KTOR-9627 Cancel blocking bridges when coroutine is cancelled
• KTOR-7067 Ktor Cookie.parseClientCookiesHeader returns Map, which breaks Cookie header contract

... (truncated)

Changelog

Sourced from io.ktor:ktor-server-content-negotiation's changelog.

3.6.0

Published 16 September 2026

Features

• KTOR-8596 OpenID Connect (OAuth2) auto-discover & configuration
• KTOR-9645 Client curated multi-platform facade module
• KTOR-8883 Support nested jars in static resources
• KTOR-8672 Support at least zstd and deflate formats of precompressed files
• KTOR-8595 Auth JWK Support (auto-discover)
• KTOR-9841 OIDC Server Plugin
• KTOR-9654 Override fetch in JS engine
• KTOR-9785 Typesafe Authentication DSL
• KTOR-462 Async CIO DNS resolver with timeout
• KTOR-9709 Add resource attribute for client resources plugin
• KTOR-5009 ContentNegotiation: Add a way to prevent changing Accept and Content-Type headers
• KTOR-9776 OpenAPI: Support the "const" validation keyword
• KTOR-7468 DefaultConversionService: Support Uuid type introduced in Kotlin 2.0
• KTOR-9578 HttpCache add method for clearing
• KTOR-9590 OpenAPI Contextual JSON schema inference support
• KTOR-6610 Log which ConfigLoader has been used for loading the server configuration
• KTOR-9735 Commonize HttpCache FileCacheStorage
• KTOR-8953 WebRTC client on JVM
• KTOR-9674 UDP support for Node.js targets
• KTOR-9612 Add text/markdown to the ContentType constants

Improvements

• KTOR-9876 Typo in KDoc for routing function: "for the this Application".
• KTOR-9778 Character classification in ktor-http hot paths uses boxed Set lookups and per-symbol encoder allocations
• KTOR-9702 Duplicate code in ByteReadChannel
• KTOR-9716 Make ApplicationCallPipeline.ApplicationPhase.Validators public in 3.6.0
• KTOR-9734 Use TagConsumer in respondHtmlFragment lambda receiver
• KTOR-5577 Support nullable types in ApplicationCall.receive
• KTOR-2367 OAuth: clients expect to get authenticated once per "session" for all protected routes
• KTOR-8594 Auth: Non-optional principal is of nullable type
• KTOR-9816 Escape $ in application.yaml file
• KTOR-8193 Unnecessary blocking in OutputStream wrapper

Bugfixes

• KTOR-8705 testApplication: call coroutine context isn't preserved when responding with ChannelWriterContent
• KTOR-9248 JWTAuthenticationProvider silently swallows exceptions
• KTOR-9892 Digest Auth client: nc and qop are not handled according to RFC 7616
• KTOR-9891 CIO on Kotlin/Native collapses above ~50 connections: HttpHeadersMap pools contend on an allocating SynchronizedObject
• KTOR-9794 Digest Auth: NullPointerException when the server does not expect Digest auth
• KTOR-9788 Netty: engine double-responds after its built-in 400, crashing the call-handler coroutine with "Headers can no longer be set because response was already completed"
• KTOR-9834 HttpClient eagerly initializes SLF4J during Android startup
• KTOR-9701 Jackson/Gson converters waste time on unnecessary Dispatchers.IO dispatch
• KTOR-9832 Apache5: Upgrading Apache HttpClient5 to version 5.6 breaks the Ktor client with Content-Length mismatch error for any gzipped content
• KTOR-9870 OkHttp: Reduce coroutine dispatching and allocations while reading response bodies
• KTOR-9627 Cancel blocking bridges when coroutine is cancelled
• KTOR-7067 Ktor Cookie.parseClientCookiesHeader returns Map, which breaks Cookie header contract

... (truncated)

Commits

• 111c580 Release 3.6.0 (#5882)
• 1e4186c KTOR-9876 Fix typo in Application.routing KDoc (#5876)
• 6930eee Fix KTOR-9892 Digest Auth client: nc and qop ... (#5875)
• 875b2f0 Fix KTOR-9794 Digest Auth: NullPointerException when the server does not expe...
• dc56137 KTOR-8705 Pass coroutine context to the channel writer (#5868)
• 55f6e71 Fix KTOR-9640 forward autoFlush in reader/writer helpers
• 2b04a1f Fix KTOR-9248 JWTAuthenticationProvider silently swallows exceptions (#5877)
• 702ff9f KTOR-9889 Fix deadlock in concurrent module loading with Dependency Injection...
• 1fab5f1 Reject Accept entries with q=0 in ContentNegotiation (#5873)
• b06c3b5 KTOR-9891 Delegate SynchronizedObject to kotlinx.atomicfu on Native (#5874)
• Additional commits viewable in compare view

Updates io.ktor:ktor-server-auth from 3.5.2 to 3.6.0

Release notes

Sourced from io.ktor:ktor-server-auth's releases.

3.6.0

Published 16 September 2026

Features

• KTOR-8596 OpenID Connect (OAuth2) auto-discover & configuration
• KTOR-9645 Client curated multi-platform facade module
• KTOR-8883 Support nested jars in static resources
• KTOR-8672 Support at least zstd and deflate formats of precompressed files
• KTOR-8595 Auth JWK Support (auto-discover)
• KTOR-9841 OIDC Server Plugin
• KTOR-9654 Override fetch in JS engine
• KTOR-9785 Typesafe Authentication DSL
• KTOR-462 Async CIO DNS resolver with timeout
• KTOR-9709 Add resource attribute for client resources plugin
• KTOR-5009 ContentNegotiation: Add a way to prevent changing Accept and Content-Type headers
• KTOR-9776 OpenAPI: Support the "const" validation keyword
• KTOR-7468 DefaultConversionService: Support Uuid type introduced in Kotlin 2.0
• KTOR-9578 HttpCache add method for clearing
• KTOR-9590 OpenAPI Contextual JSON schema inference support
• KTOR-6610 Log which ConfigLoader has been used for loading the server configuration
• KTOR-9735 Commonize HttpCache FileCacheStorage
• KTOR-8953 WebRTC client on JVM
• KTOR-9674 UDP support for Node.js targets
• KTOR-9612 Add text/markdown to the ContentType constants

Improvements

• KTOR-9876 Typo in KDoc for routing function: "for the this Application".
• KTOR-9778 Character classification in ktor-http hot paths uses boxed Set lookups and per-symbol encoder allocations
• KTOR-9702 Duplicate code in ByteReadChannel
• KTOR-9716 Make ApplicationCallPipeline.ApplicationPhase.Validators public in 3.6.0
• KTOR-9734 Use TagConsumer in respondHtmlFragment lambda receiver
• KTOR-5577 Support nullable types in ApplicationCall.receive
• KTOR-2367 OAuth: clients expect to get authenticated once per "session" for all protected routes
• KTOR-8594 Auth: Non-optional principal is of nullable type
• KTOR-9816 Escape $ in application.yaml file
• KTOR-8193 Unnecessary blocking in OutputStream wrapper

Bugfixes

• KTOR-8705 testApplication: call coroutine context isn't preserved when responding with ChannelWriterContent
• KTOR-9248 JWTAuthenticationProvider silently swallows exceptions
• KTOR-9892 Digest Auth client: nc and qop are not handled according to RFC 7616
• KTOR-9891 CIO on Kotlin/Native collapses above ~50 connections: HttpHeadersMap pools contend on an allocating SynchronizedObject
• KTOR-9794 Digest Auth: NullPointerException when the server does not expect Digest auth
• KTOR-9788 Netty: engine double-responds after its built-in 400, crashing the call-handler coroutine with "Headers can no longer be set because response was already completed"
• KTOR-9834 HttpClient eagerly initializes SLF4J during Android startup
• KTOR-9701 Jackson/Gson converters waste time on unnecessary Dispatchers.IO dispatch
• KTOR-9832 Apache5: Upgrading Apache HttpClient5 to version 5.6 breaks the Ktor client with Content-Length mismatch error for any gzipped content
• KTOR-9870 OkHttp: Reduce coroutine dispatching and allocations while reading response bodies
• KTOR-9627 Cancel blocking bridges when coroutine is cancelled
• KTOR-7067 Ktor Cookie.parseClientCookiesHeader returns Map, which breaks Cookie header contract

... (truncated)

Changelog

Sourced from io.ktor:ktor-server-auth's changelog.

3.6.0

Published 16 September 2026

Features

• KTOR-8596 OpenID Connect (OAuth2) auto-discover & configuration
• KTOR-9645 Client curated multi-platform facade module
• KTOR-8883 Support nested jars in static resources
• KTOR-8672 Support at least zstd and deflate formats of precompressed files
• KTOR-8595 Auth JWK Support (auto-discover)
• KTOR-9841 OIDC Server Plugin
• KTOR-9654 Override fetch in JS engine
• KTOR-9785 Typesafe Authentication DSL
• KTOR-462 Async CIO DNS resolver with timeout
• KTOR-9709 Add resource attribute for client resources plugin
• KTOR-5009 ContentNegotiation: Add a way to prevent changing Accept and Content-Type headers
• KTOR-9776 OpenAPI: Support the "const" validation keyword
• KTOR-7468 DefaultConversionService: Support Uuid type introduced in Kotlin 2.0
• KTOR-9578 HttpCache add method for clearing
• KTOR-9590 OpenAPI Contextual JSON schema inference support
• KTOR-6610 Log which ConfigLoader has been used for loading the server configuration
• KTOR-9735 Commonize HttpCache FileCacheStorage
• KTOR-8953 WebRTC client on JVM
• KTOR-9674 UDP support for Node.js targets
• KTOR-9612 Add text/markdown to the ContentType constants

Improvements

• KTOR-9876 Typo in KDoc for routing function: "for the this Application".
• KTOR-9778 Character classification in ktor-http hot paths uses boxed Set lookups and per-symbol encoder allocations
• KTOR-9702 Duplicate code in ByteReadChannel
• KTOR-9716 Make ApplicationCallPipeline.ApplicationPhase.Validators public in 3.6.0
• KTOR-9734 Use TagConsumer in respondHtmlFragment lambda receiver
• KTOR-5577 Support nullable types in ApplicationCall.receive
• KTOR-2367 OAuth: clients expect to get authenticated once per "session" for all protected routes
• KTOR-8594 Auth: Non-optional principal is of nullable type
• KTOR-9816 Escape $ in application.yaml file
• KTOR-8193 Unnecessary blocking in OutputStream wrapper

Bugfixes

• KTOR-8705 testApplication: call coroutine context isn't preserved when responding with ChannelWriterContent
• KTOR-9248 JWT...

  Description has been truncated