deps: bump the gradle-minor-and-patch group across 1 directory with 18 updates

[dependabot]

Bumps the gradle-minor-and-patch group with 18 updates in the / directory:

Package	From	To
gradle-wrapper	9.5.1	9.6.1
org.junit.platform:junit-platform-launcher	6.1.0	6.1.1
org.junit.jupiter:junit-jupiter-api	6.1.0	6.1.1
org.junit.jupiter:junit-jupiter-engine	6.1.0	6.1.1
org.junit.vintage:junit-vintage-engine	6.1.0	6.1.1
com.google.dagger:hilt-android	2.59.2	2.60
com.google.dagger:hilt-android-compiler	2.59.2	2.60
org.junit.jupiter:junit-jupiter-params	6.1.0	6.1.1
io.ktor:ktor-server-core-jvm	3.5.0	3.5.1
io.ktor:ktor-server-netty-jvm	3.5.0	3.5.1
io.ktor:ktor-server-cio-jvm	3.5.0	3.5.1
org.checkerframework:checker-qual	4.1.0	4.2.0
org.jetbrains.kotlin:kotlin-test-junit	2.3.21	2.4.0
org.jetbrains.kotlin.android	2.3.21	2.4.0
org.jetbrains.kotlin.plugin.compose	2.3.21	2.4.0
org.jetbrains.kotlin.plugin.serialization	2.3.21	2.4.0
com.google.dagger.hilt.android	2.59.2	2.60
com.google.devtools.ksp	2.3.8	2.3.9

Updates gradle-wrapper from 9.5.1 to 9.6.1

Release notes

Sourced from gradle-wrapper's releases.

9.6.1

The Gradle team is excited to announce Gradle 9.6.1.

Here are the highlights of this release:

• Improved Configuration Cache hit rates
• Additional CLI rendering options
• Important project hierarchy lookup deprecations

Read the Release Notes

We would like to thank the following community members for their contributions to this release of Gradle: Aharnish Solanki, Benedikt Johannes, Devendra Reddy Pennabadi, Dmytro Rodionov, Dreeam, Elías Hernández Rodríguez, Eng Zer Jun, FinlayRJW, Kamal Kansal, Marcono1234, Nelson Osacky, Philip Wedemann, Ravi, Roberto Perez Alcolea, Ryan Schmitt, Sebastian Schuberth, seunghun.ham, sk-reddy17, Suvrat Acharya, Vedant Madane.

Upgrade instructions

Switch your build to use Gradle 9.6.1 by updating your wrapper:

./gradlew :wrapper --gradle-version=9.6.1 && ./gradlew :wrapper

See the Gradle 9.x upgrade guide to learn about deprecations, breaking changes and other considerations when upgrading.

For Java, Groovy, Kotlin and Android compatibility, see the full compatibility notes.

Reporting problems

If you find a problem with this release, please file a bug on GitHub Issues adhering to our issue guidelines. If you're not sure you're encountering a bug, please use the forum.

We hope you will build happiness with Gradle, and we look forward to your feedback via Twitter or on GitHub.

9.6.0

... (truncated)

Commits

• 309d128 Update fixed issues in release notes for 9.6.1 (#38328)
• 040a978 Update fixed issues in release notes for 9.6.1
• e0b8325 Restore --non-interactive flag instead of --interactive/--no-interactive (#38...
• 946f3e6 Limit explicit temp file permission setting to intended use case (#38300)
• 65f8224 Restore --non-interactive flag instead of --interactive/--no-interactive
• e346a5e Adjust CLI flag to configure non-interactive console (#38301)
• 9b53be9 Adjust CLI flag to configure non-interactive console
• 0dd3b53 Limit explicit temp file permission setting to intended use case
• 48e5ac2 Add reproducers
• 25598fd Prepare 9.6.1 patch release (#38293)
• Additional commits viewable in compare view

Updates org.junit.platform:junit-platform-launcher from 6.1.0 to 6.1.1

Release notes

Sourced from org.junit.platform:junit-platform-launcher's releases.

JUnit 6.1.1 = Platform 6.1.1 + Jupiter 6.1.1 + Vintage 6.1.1

See Release Notes.

Full Changelog: junit-team/junit-framework@r6.1.0...r6.1.1

Commits

• 0d85889 Release 6.1.1
• 0363eee Finalize 6.1.1 release notes
• a6d540a Move entry to 6.1.1 release notes
• 69339d5 Only pass timeout when publishing to avoid failure in nmcp plugin
• dec2eb9 Allow excluding engines from memory cleanup mode (#5786)
• a5f4270 Publish sha256/sha512 checksums again but filter out signature ones (#5796)
• 8213012 Update plugin nmcp-settings to v1.6.0 (#5787)
• d1bf847 Generate Javadoc for aggregator modules
• d721de5 Pass --no-fonts to javadoc convention
• d289ec6 Restore original SetSystemProperty values in a ParameterizedTest (#5720)
• Additional commits viewable in compare view

Updates org.junit.jupiter:junit-jupiter-api from 6.1.0 to 6.1.1

Release notes

Sourced from org.junit.jupiter:junit-jupiter-api's releases.

JUnit 6.1.1 = Platform 6.1.1 + Jupiter 6.1.1 + Vintage 6.1.1

See Release Notes.

Full Changelog: junit-team/junit-framework@r6.1.0...r6.1.1

Commits

• 0d85889 Release 6.1.1
• 0363eee Finalize 6.1.1 release notes
• a6d540a Move entry to 6.1.1 release notes
• 69339d5 Only pass timeout when publishing to avoid failure in nmcp plugin
• dec2eb9 Allow excluding engines from memory cleanup mode (#5786)
• a5f4270 Publish sha256/sha512 checksums again but filter out signature ones (#5796)
• 8213012 Update plugin nmcp-settings to v1.6.0 (#5787)
• d1bf847 Generate Javadoc for aggregator modules
• d721de5 Pass --no-fonts to javadoc convention
• d289ec6 Restore original SetSystemProperty values in a ParameterizedTest (#5720)
• Additional commits viewable in compare view

Updates org.junit.jupiter:junit-jupiter-engine from 6.1.0 to 6.1.1

Release notes

Sourced from org.junit.jupiter:junit-jupiter-engine's releases.

JUnit 6.1.1 = Platform 6.1.1 + Jupiter 6.1.1 + Vintage 6.1.1

See Release Notes.

Full Changelog: junit-team/junit-framework@r6.1.0...r6.1.1

Commits

• 0d85889 Release 6.1.1
• 0363eee Finalize 6.1.1 release notes
• a6d540a Move entry to 6.1.1 release notes
• 69339d5 Only pass timeout when publishing to avoid failure in nmcp plugin
• dec2eb9 Allow excluding engines from memory cleanup mode (#5786)
• a5f4270 Publish sha256/sha512 checksums again but filter out signature ones (#5796)
• 8213012 Update plugin nmcp-settings to v1.6.0 (#5787)
• d1bf847 Generate Javadoc for aggregator modules
• d721de5 Pass --no-fonts to javadoc convention
• d289ec6 Restore original SetSystemProperty values in a ParameterizedTest (#5720)
• Additional commits viewable in compare view

Updates org.junit.vintage:junit-vintage-engine from 6.1.0 to 6.1.1

Release notes

Sourced from org.junit.vintage:junit-vintage-engine's releases.

JUnit 6.1.1 = Platform 6.1.1 + Jupiter 6.1.1 + Vintage 6.1.1

See Release Notes.

Full Changelog: junit-team/junit-framework@r6.1.0...r6.1.1

Commits

• 0d85889 Release 6.1.1
• 0363eee Finalize 6.1.1 release notes
• a6d540a Move entry to 6.1.1 release notes
• 69339d5 Only pass timeout when publishing to avoid failure in nmcp plugin
• dec2eb9 Allow excluding engines from memory cleanup mode (#5786)
• a5f4270 Publish sha256/sha512 checksums again but filter out signature ones (#5796)
• 8213012 Update plugin nmcp-settings to v1.6.0 (#5787)
• d1bf847 Generate Javadoc for aggregator modules
• d721de5 Pass --no-fonts to javadoc convention
• d289ec6 Restore original SetSystemProperty values in a ParameterizedTest (#5720)
• Additional commits viewable in compare view

Updates com.google.dagger:hilt-android from 2.59.2 to 2.60

Release notes

Sourced from com.google.dagger:hilt-android's releases.

Dagger 2.60

New features:

• Fixes #5165: Support nullable type annotations when using the flag -Adagger.nullableTypeAnnotations=enabled. For more details see https://dagger.dev/dev-guide/compiler-options#nullable-type-annotations. (4bedb4b64)
• Fixes #5087: When using the Hilt Gradle plugin, you can now disable fastInit mode from the command line, e.g. -Pdagger.hilt.fastInit=false. For more details see https://dagger.dev/hilt/flags#fast-init. (0f7642ba1)
• Introduced parameterless @Binds methods to explicitly bind @Inject constructors. For more details see https://dagger.dev/dev-guide/#parameterless-binds. (4c81e9416)

Potential breaking changes:

• When using the Hilt Gradle plugin, an error is now reported if a user sets a plugin-controlled flag (previously the plugin just ignored the user’s input). (a119ba68c)
• Multidex support is removed. minSDK for Hilt is now 23, matching AndroidX (https://issuetracker.google.com/380448311) (1990bd1c4)

Bug fixes:

• Fixes #1290: Enabled Guava BetaApi checks (5b8b2bdbe)
• Fixes #5190, #5180, #5177: Updated Kotlin version ton 2.3.21 (7daaec5a9)
• Fixes #5160: Deferred ViewModelMetadata processing on error types or missing @​AssistedFactory (59827c699)
• Fixes missing originating element attachments in a few Hilt processors to ensure correct incremental compilation tracking. (2930ca837)
• Fixes Dagger multibinding duplicate masking across Map components (compile-time validation) Adds strict compile-time detection for duplicate map multibinding keys across component boundaries. This is enabled via the -Adagger.mapMultibindingDuplicateDetectionFix=ENABLED. This option is DISABLED by default to maintain backward compatibility. See Compiler Options for more details. (504397ebe)

Commits

• d9ccdc7 2.60 release
• 7451e37 Add dependenciesRequested to ProducerMonitor
• e820a70 Refactor: Inline library sources directly within MembersInjectionValidationTest
• 4bedb4b Support nullable type annotations with a flag.
• 445e6f0 Fix wording on ProducerMonitor methodStarting and ready javadocs
• 5b8b2bd Enable Guava BetaApi checks in Dagger's Bazel build.
• 639cd2b Temporarily disable a few KSP tests before updating XProcessing artifacts.
• 5988296 Handle RuntimeExceptions in DaggerSuperficialValidation getMessage / trac...
• 2227e70 Remove unused ProcessorErrors methods.
• 7daaec5 Update Kotlin and KSP versions to 2.3.
• Additional commits viewable in compare view

Updates com.google.dagger:hilt-android-compiler from 2.59.2 to 2.60

Release notes

Sourced from com.google.dagger:hilt-android-compiler's releases.

Dagger 2.60

New features:

• Fixes #5165: Support nullable type annotations when using the flag -Adagger.nullableTypeAnnotations=enabled. For more details see https://dagger.dev/dev-guide/compiler-options#nullable-type-annotations. (4bedb4b64)
• Fixes #5087: When using the Hilt Gradle plugin, you can now disable fastInit mode from the command line, e.g. -Pdagger.hilt.fastInit=false. For more details see https://dagger.dev/hilt/flags#fast-init. (0f7642ba1)
• Introduced parameterless @Binds methods to explicitly bind @Inject constructors. For more details see https://dagger.dev/dev-guide/#parameterless-binds. (4c81e9416)

Potential breaking changes:

• When using the Hilt Gradle plugin, an error is now reported if a user sets a plugin-controlled flag (previously the plugin just ignored the user’s input). (a119ba68c)
• Multidex support is removed. minSDK for Hilt is now 23, matching AndroidX (https://issuetracker.google.com/380448311) (1990bd1c4)

Bug fixes:

• Fixes #1290: Enabled Guava BetaApi checks (5b8b2bdbe)
• Fixes #5190, #5180, #5177: Updated Kotlin version ton 2.3.21 (7daaec5a9)
• Fixes #5160: Deferred ViewModelMetadata processing on error types or missing @​AssistedFactory (59827c699)
• Fixes missing originating element attachments in a few Hilt processors to ensure correct incremental compilation tracking. (2930ca837)
• Fixes Dagger multibinding duplicate masking across Map components (compile-time validation) Adds strict compile-time detection for duplicate map multibinding keys across component boundaries. This is enabled via the -Adagger.mapMultibindingDuplicateDetectionFix=ENABLED. This option is DISABLED by default to maintain backward compatibility. See Compiler Options for more details. (504397ebe)

Commits

• d9ccdc7 2.60 release
• 7451e37 Add dependenciesRequested to ProducerMonitor
• e820a70 Refactor: Inline library sources directly within MembersInjectionValidationTest
• 4bedb4b Support nullable type annotations with a flag.
• 445e6f0 Fix wording on ProducerMonitor methodStarting and ready javadocs
• 5b8b2bd Enable Guava BetaApi checks in Dagger's Bazel build.
• 639cd2b Temporarily disable a few KSP tests before updating XProcessing artifacts.
• 5988296 Handle RuntimeExceptions in DaggerSuperficialValidation getMessage / trac...
• 2227e70 Remove unused ProcessorErrors methods.
• 7daaec5 Update Kotlin and KSP versions to 2.3.
• Additional commits viewable in compare view

Updates com.google.dagger:hilt-android-compiler from 2.59.2 to 2.60

Release notes

Sourced from com.google.dagger:hilt-android-compiler's releases.

Dagger 2.60

New features:

• Fixes #5165: Support nullable type annotations when using the flag -Adagger.nullableTypeAnnotations=enabled. For more details see https://dagger.dev/dev-guide/compiler-options#nullable-type-annotations. (4bedb4b64)
• Fixes #5087: When using the Hilt Gradle plugin, you can now disable fastInit mode from the command line, e.g. -Pdagger.hilt.fastInit=false. For more details see https://dagger.dev/hilt/flags#fast-init. (0f7642ba1)
• Introduced parameterless @Binds methods to explicitly bind @Inject constructors. For more details see https://dagger.dev/dev-guide/#parameterless-binds. (4c81e9416)

Potential breaking changes:

• When using the Hilt Gradle plugin, an error is now reported if a user sets a plugin-controlled flag (previously the plugin just ignored the user’s input). (a119ba68c)
• Multidex support is removed. minSDK for Hilt is now 23, matching AndroidX (https://issuetracker.google.com/380448311) (1990bd1c4)

Bug fixes:

• Fixes #1290: Enabled Guava BetaApi checks (5b8b2bdbe)
• Fixes #5190, #5180, #5177: Updated Kotlin version ton 2.3.21 (7daaec5a9)
• Fixes #5160: Deferred ViewModelMetadata processing on error types or missing @​AssistedFactory (59827c699)
• Fixes missing originating element attachments in a few Hilt processors to ensure correct incremental compilation tracking. (2930ca837)
• Fixes Dagger multibinding duplicate masking across Map components (compile-time validation) Adds strict compile-time detection for duplicate map multibinding keys across component boundaries. This is enabled via the -Adagger.mapMultibindingDuplicateDetectionFix=ENABLED. This option is DISABLED by default to maintain backward compatibility. See Compiler Options for more details. (504397ebe)

Commits

• d9ccdc7 2.60 release
• 7451e37 Add dependenciesRequested to ProducerMonitor
• e820a70 Refactor: Inline library sources directly within MembersInjectionValidationTest
• 4bedb4b Support nullable type annotations with a flag.
• 445e6f0 Fix wording on ProducerMonitor methodStarting and ready javadocs
• 5b8b2bd Enable Guava BetaApi checks in Dagger's Bazel build.
• 639cd2b Temporarily disable a few KSP tests before updating XProcessing artifacts.
• 5988296 Handle RuntimeExceptions in DaggerSuperficialValidation getMessage / trac...
• 2227e70 Remove unused ProcessorErrors methods.
• 7daaec5 Update Kotlin and KSP versions to 2.3.
• Additional commits viewable in compare view

Updates org.junit.jupiter:junit-jupiter-params from 6.1.0 to 6.1.1

Release notes

Sourced from org.junit.jupiter:junit-jupiter-params's releases.

JUnit 6.1.1 = Platform 6.1.1 + Jupiter 6.1.1 + Vintage 6.1.1

See Release Notes.

Full Changelog: junit-team/junit-framework@r6.1.0...r6.1.1

Commits

• 0d85889 Release 6.1.1
• 0363eee Finalize 6.1.1 release notes
• a6d540a Move entry to 6.1.1 release notes
• 69339d5 Only pass timeout when publishing to avoid failure in nmcp plugin
• dec2eb9 Allow excluding engines from memory cleanup mode (#5786)
• a5f4270 Publish sha256/sha512 checksums again but filter out signature ones (#5796)
• 8213012 Update plugin nmcp-settings to v1.6.0 (#5787)
• d1bf847 Generate Javadoc for aggregator modules
• d721de5 Pass --no-fonts to javadoc convention
• d289ec6 Restore original SetSystemProperty values in a ParameterizedTest (#5720)
• Additional commits viewable in compare view

Updates io.ktor:ktor-server-core-jvm from 3.5.0 to 3.5.1

Release notes

Sourced from io.ktor:ktor-server-core-jvm's releases.

3.5.1

Published 25 June 2026

Improvements

• KTOR-9492 OpenAPI plugin: handle requireXxx functions in compiler plugin
• KTOR-9569 Add more details for KDoc of BearerAuthConfig.sendWithoutRequest
• KTOR-9571 Add KDoc for BearerAuthConfig.realm
• KTOR-9570 Add Kdoc for BearerAuthConfig.refreshTokens

Bugfixes

• KTOR-9646 Fix Kotlin 2.4.0 compiler plugin breaking changes
• KTOR-9585 OpenAPI: JsonSchema title is truncated when it contains a dot
• KTOR-9591 OpenAPI: @JsonClassDiscriminator on sealed types is ignored when generating OpenAPI discriminator schema
• KTOR-9597 OpenAPI: Schema name collisions because@SerialName of sealed subtypes is used as components.schemas key
• KTOR-9601 OpenAPI: nullable @​JvmInline value class loses nullability in generated schema
• KTOR-9620 Some issues related to digest authentication in 3.5.0
• KTOR-9623 Digest Auth: server must respond with one WWW-Authenticate header for each supported algorithm
• KTOR-9624 Digest Auth: "Unsupported charset in digest authentication header" for a charset name in lowercase
• KTOR-9630 Digest Auth: The plugin sends incorrect nonce when server responds with multiple WWW-Authenticate headers
• KTOR-9565 WebRTC: Peer stops receiving messages after a while on iOS
• KTOR-9610 WebRtcPeerConnection::close causes ClosedReceiveChannelException for other peer
• KTOR-9633 WebRTC statistics fetching race condition
• KTOR-9603 Structured concurrency is violated in WebRTC tests
• KTOR-9671 Darwin: Semicolons in URL path are sanitized
• KTOR-9639 Darwin: WebSocket client crashes the process when a PONG arrives after the session is closed
• KTOR-9575 Darwin: findCharset("UTF-16") maps to NSUTF16LittleEndianStringEncoding causing decoding failure for UTF-16 content with BOM
• KTOR-9661 HttpCache: InvalidCacheStateException is thrown on 304 when no cached entry matches varyKeys
• KTOR-9673 Caching always missing with Content Negotiation
• KTOR-9596 HttpTimeout: HttpRequestTimeoutException on any request with runTest and request timeout defined since 3.5.0
• KTOR-9632 HttpRequestBuilder.timeout call removes capabilities set in DefaultRequest
• KTOR-9252 ContentEncoding: Incomplete gzip response causes client/server to hang indefinitely
• KTOR-9670 Compression: The plugin ignores Accept-Encoding q=0 and most-specific matching
• KTOR-9614 Zstd Compression: "Destination buffer is too small" exception for a particular sequence of bytes
• KTOR-9636 CORS plugin drops OPTIONS preflight requests when allowSameOrigin is on
• KTOR-9659 CORS is skipped when the Origin header contains an IPv6 address
• KTOR-9574 ContentNegotiation: The charset of Accept-Charset header is used for response deserialization
• KTOR-9606 KotlinxSerializationConverter: it fails to deserialize an empty channel closed with a delay
• KTOR-9617 OutputStreamContent and WriterContent can exhaust Dispatchers.IO
• KTOR-9629 RawSourceChannel: coroutine cancellation is not propagated to the RawSource
• KTOR-8870 File.readChannel: do not close a non-opened file and ignore closing exceptions
• KTOR-9460 Curl: Can't build shared library with Ktor 3.4.2
• KTOR-9607 Crash on Android 7: NoSuchMethodError getInstanceStrong() since 3.5.0
• KTOR-9595 CIO: The engine imports node:net statically and breaks wasmJsBrowser webpack build
• KTOR-9615 Apache5: The underlying request is not aborted when coroutine Job is cancelled
• KTOR-8443 RoutingBuilder.contentType does not use parameters when matching
• KTOR-9425 SessionTransportTransformerEncrypt init block uses wrong IV size for AES-256 (regression of KTOR-661)
• KTOR-9621 RateLimit plugin is bypassed when the nested authenticate block rejects the request
• KTOR-8766 DI: The close method is called twice on cleanup of AutoCloseable
• KTOR-8695 GMTDate() being offset by 369 years on Windows
• KTOR-9589 Duplicate PROPERTY_SETTER target in @InternalAPI annotation

... (truncated)

Changelog

Sourced from io.ktor:ktor-server-core-jvm's changelog.

3.5.1

Published 25 June 2026

Improvements

• KTOR-9492 OpenAPI plugin: handle requireXxx functions in compiler plugin
• KTOR-9569 Add more details for KDoc of BearerAuthConfig.sendWithoutRequest
• KTOR-9571 Add KDoc for BearerAuthConfig.realm
• KTOR-9570 Add Kdoc for BearerAuthConfig.refreshTokens

Bugfixes

• KTOR-9646 Fix Kotlin 2.4.0 compiler plugin breaking changes
• KTOR-9585 OpenAPI: JsonSchema title is truncated when it contains a dot
• KTOR-9591 OpenAPI: @JsonClassDiscriminator on sealed types is ignored when generating OpenAPI discriminator schema
• KTOR-9597 OpenAPI: Schema name collisions because@SerialName of sealed subtypes is used as components.schemas key
• KTOR-9601 OpenAPI: nullable @​JvmInline value class loses nullability in generated schema
• KTOR-9620 Some issues related to digest authentication in 3.5.0
• KTOR-9623 Digest Auth: server must respond with one WWW-Authenticate header for each supported algorithm
• KTOR-9624 Digest Auth: "Unsupported charset in digest authentication header" for a charset name in lowercase
• KTOR-9630 Digest Auth: The plugin sends incorrect nonce when server responds with multiple WWW-Authenticate headers
• KTOR-9565 WebRTC: Peer stops receiving messages after a while on iOS
• KTOR-9610 WebRtcPeerConnection::close causes ClosedReceiveChannelException for other peer
• KTOR-9633 WebRTC statistics fetching race condition
• KTOR-9603 Structured concurrency is violated in WebRTC tests
• KTOR-9671 Darwin: Semicolons in URL path are sanitized
• KTOR-9639 Darwin: WebSocket client crashes the process when a PONG arrives after the session is closed
• KTOR-9575 Darwin: findCharset("UTF-16") maps to NSUTF16LittleEndianStringEncoding causing decoding failure for UTF-16 content with BOM
• KTOR-9661 HttpCache: InvalidCacheStateException is thrown on 304 when no cached entry matches varyKeys
• KTOR-9673 Caching always missing with Content Negotiation
• KTOR-9596 HttpTimeout: HttpRequestTimeoutException on any request with runTest and request timeout defined since 3.5.0
• KTOR-9632 HttpRequestBuilder.timeout call removes capabilities set in DefaultRequest
• KTOR-9252 ContentEncoding: Incomplete gzip response causes client/server to hang indefinitely
• KTOR-9670 Compression: The plugin ignores Accept-Encoding q=0 and most-specific matching
• KTOR-9614 Zstd Compression: "Destination buffer is too small" exception for a particular sequence of bytes
• KTOR-9636 CORS plugin drops OPTIONS preflight requests when allowSameOrigin is on
• KTOR-9659 CORS is skipped when the Origin header contains an IPv6 address
• KTOR-9574 ContentNegotiation: The charset of Accept-Charset header is used for response deserialization
• KTOR-9606 KotlinxSerializationConverter: it fails to deserialize an empty channel closed with a delay
• KTOR-9617 OutputStreamContent and WriterContent can exhaust Dispatchers.IO
• KTOR-9629 RawSourceChannel: coroutine cancellation is not propagated to the RawSource
• KTOR-8870 File.readChannel: do not close a non-opened file and ignore closing exceptions
• KTOR-9460 Curl: Can't build shared library with Ktor 3.4.2
• KTOR-9607 Crash on Android 7: NoSuchMethodError getInstanceStrong() since 3.5.0
• KTOR-9595 CIO: The engine imports node:net statically and breaks wasmJsBrowser webpack build
• KTOR-9615 Apache5: The underlying request is not aborted when coroutine Job is cancelled
• KTOR-8443 RoutingBuilder.contentType does not use parameters when matching
• KTOR-9425 SessionTransportTransformerEncrypt init block uses wrong IV size for AES-256 (regression of KTOR-661)
• KTOR-9621 RateLimit plugin is bypassed when the nested authenticate block rejects the request
• KTOR-8766 DI: The close method is called twice on cleanup of AutoCloseable
• KTOR-8695 GMTDate() being offset by 369 years on Windows
• KTOR-9589 Duplicate PROPERTY_SETTER target in @​InternalAPI annotation

... (truncated)

Commits

• 5ba9d6f Release 3.5.1 (#5719)
• a4f145d KTOR-9661 HttpCache: InvalidCacheStateException is thrown on 304 when… (#5701)
• 2caf278 Fix failing :ktor-io:compileDarwinMainKotlinMetadata (#5716)
• 257de90 KTOR-8766 Fix multiple invocations of close from DI
• e77a168 Fix cache misses with content negotiation 3x (#5714)
• ed22950 Make huge post test less huge
• f329069 Update dependency com.github.luben:zstd-jni to v1.5.7-11
• 6ecd072 Update dependency io.swagger.parser.v3:swagger-parser to v2.1.44
• a0534cd Update dependency io.pebbletemplates:pebble to v4.1.2
• 8647e53 Update dependency com.typesafe:config to v1.4.9
• Additional commits viewable in compare view

Updates io.ktor:ktor-server-netty-jvm from 3.5.0 to 3.5.1

Release notes

Sourced from io.ktor:ktor-server-netty-jvm's releases.

3.5.1

Published 25 June 2026

Improvements

• KTOR-9492 OpenAPI plugin: handle requireXxx functions in compiler plugin
• KTOR-9569 Add more details for KDoc of BearerAuthConfig.sendWithoutRequest
• KTOR-9571 Add KDoc for BearerAuthConfig.realm
• KTOR-9570 Add Kdoc for BearerAuthConfig.refreshTokens

Bugfixes

• KTOR-9646 Fix Kotlin 2.4.0 compiler plugin breaking changes
• KTOR-9585 OpenAPI: JsonSchema title is truncated when it contains a dot
• KTOR-9591 OpenAPI: @JsonClassDiscriminator on sealed types is ignored when generating OpenAPI discriminator schema
• KTOR-9597 OpenAPI: Schema name collisions because@SerialName of sealed subtypes is used as components.schemas key
• KTOR-9601 OpenAPI: nullable @​JvmInline value class loses nullability in generated schema
• KTOR-9620 Some issues related to digest authentication in 3.5.0
• KTOR-9623 Digest Auth: server must respond with one WWW-Authenticate header for each supported algorithm
• KTOR-9624 Digest Auth: "Unsupported charset in digest authentication header" for a charset name in lowercase
• KTOR-9630 Digest Auth: The plugin sends incorrect nonce when server responds with multiple WWW-Authenticate headers
• KTOR-9565 WebRTC: Peer stops receiving messages after a while on iOS
• KTOR-9610 WebRtcPeerConnection::close causes ClosedReceiveChannelException for other peer
• KTOR-9633 WebRTC statistics fetching race condition
• KTOR-9603 Structured concurrency is violated in WebRTC tests
• KTOR-9671 Darwin: Semicolons in URL path are sanitized
• KTOR-9639 Darwin: WebSocket client crashes the process when a PONG arrives after the session is closed
• KTOR-9575 Darwin: findCharset("UTF-16") maps to NSUTF16LittleEndianStringEncoding causing decoding failure for UTF-16 content with BOM
• KTOR-9661 HttpCache: InvalidCacheStateException is thrown on 304 when no cached entry matches varyKeys
• KTOR-9673 Caching always missing with Content Negotiation
• KTOR-9596 HttpTimeout: HttpRequestTimeoutException on any request with runTest and request timeout defined since 3.5.0
• KTOR-9632 HttpRequestBuilder.timeout call removes capabilities set in DefaultRequest
• KTOR-9252 ContentEncoding: Incomplete gzip response causes client/server to hang indefinitely
• KTOR-9670 Compression: The plugin ignores Accept-Encoding q=0 and most-specific matching
• KTOR-9614 Zstd Compression: "Destination buffer is too small" exception for a particular sequence of bytes
• KTOR-9636 CORS plugin drops OPTIONS preflight requests when allowSameOrigin is on
• KTOR-9659 CORS is skipped when the Origin header contains an IPv6 address
• KTOR-9574 ContentNegotiation: The charset of Accept-Charset header is used for response deserialization
• KTOR-9606 KotlinxSerializationConverter: it fails to deserialize an empty channel closed with a delay
• KTOR-9617 OutputStreamContent and WriterContent can exhaust Dispatchers.IO
• KTOR-9629 RawSourceChannel: coroutine cancellation is not propagated to the RawSource
• KTOR-8870 File.readChannel: do not close a non-opened file and ignore closing exceptions
• KTOR-9460 Curl: Can't build shared library with Ktor 3.4.2
• KTOR-9607 Crash on Android 7: NoSuchMethodError getInstanceStrong() since 3.5.0
• KTOR-9595 CIO: The engine imports node:net statically and breaks wasmJsBrowser webpack build
• KTOR-9615 Apache5: The underlying request is not aborted when coroutine Job is cancelled
• KTOR-8443 RoutingBuilder.contentType does not use parameters when matching
• KTOR-9425 SessionTransportTransformerEncrypt init block uses wrong IV size for AES-256 (regression of KTOR-661)
• KTOR-9621 RateLimit plugin is bypassed when the nested authenticate block rejects the request
• KTOR-8766 DI: The close method is called twice on cleanup of AutoCloseable
• KTOR-8695 GMTDate() being offset by 369 years on Windows
• KTOR-9589 Duplicate PROPERTY_SETTER target in @InternalAPI annotation

... (truncated)

Changelog

Sourced from io.ktor:ktor-server-netty-jvm's changelog.

3.5.1

Published 25 June 2026

Improvements

• KTOR-9492 OpenAPI plugin: handle requireXxx functions in compiler plugin
• KTOR-9569 Add more details for KDoc of BearerAuthConfig.sendWithoutRequest
• KTOR-9571 Add KDoc for BearerAuthConfig.realm
• KTOR-9570 Add Kdoc for BearerAuthConfig.refreshTokens

Bugfixes

• KTOR-9646 Fix Kotlin 2.4.0 compiler plugin breaking changes
• KTOR-9585 OpenAPI: JsonSchema title is truncated when it contains a dot
• KTOR-9591 OpenAPI: @JsonClassDiscriminator on sealed types is ignored when generating OpenAPI discriminator schema
• KTOR-9597 OpenAPI: Schema name collisions because@SerialName of sealed subtypes is used as components.schemas key
• KTOR-9601 OpenAPI: nullable @​JvmInline value class loses nullability in generated schema
• KTOR-9620 Some issues related to digest authentication in 3.5.0
• KTOR-9623 Digest Auth: server must respond with one WWW-Authenticate header for each supported algorithm
• KTOR-9624 Digest Auth: "Unsupported charset in digest authentication header" for a charset name in lowercase
• KTOR-9630 Digest Auth: The plugin sends incorrect nonce when server responds with multiple WWW-Authenticate headers
• KTOR-9565 WebRTC: Peer stops receiving messages after a while on iOS

[lostf1sh]

@claude hi

[lostf1sh]

@claude are these deps safe to update ?

[lostf1sh]

@claude are these deps safe to update ?

[github-actions]

Claude finished @lostf1sh's task in 1m 36s —— View job

---

Dependency safety review

• Read the request: Duhan asked whether these 18 dependency bumps are safe to update
• Reviewed changelogs/release notes for each updated dependency for breaking changes
• Checked the actual diff and project config (app/build.gradle.kts, gradle/libs.versions.toml)
• Posted final assessment

Short answer: yes, this batch looks safe. All bumps are patch or minor releases, and I didn't find anything in this project that the documented breaking changes would touch.

Details:

Dependency	Change	Notes
Gradle wrapper	9.5.1 → 9.6.1	Patch release (CLI/config-cache fixes only).
JUnit Platform/Jupiter/Vintage/Params	6.1.0 → 6.1.1	Patch release, bugfixes only.
com.google.dagger:hilt-android* / com.google.dagger.hilt.android	2.59.2 → 2.60	New features + 2 "potential breaking changes": (1) Hilt Gradle plugin now errors instead of silently ignoring plugin-controlled flags — app/build.gradle.kts doesn't set any of these, so unaffected. (2) Multidex support removed, Hilt's minSdk is now 23 — this project's minSdk = 30 (app/build.gradle.kts:75), well above that, so unaffected.
io.ktor:ktor-server-*-jvm	3.5.0 → 3.5.1	Patch release. Notably includes "Fix Kotlin 2.4.0 compiler plugin breaking changes" (KTOR-9646) — i.e. this Ktor patch exists specifically to stay compatible with the Kotlin 2.4.0 bump also in this PR, which is a good sign the two were bumped together intentionally.
org.checkerframework:checker-qual	4.1.0 → 4.2.0	Transitive annotation-processing dep, minor bump.
org.jetbrains.kotlin* (android/compose/serialization plugins, kotlin-test-junit)	2.3.21 → 2.4.0	Minor Kotlin version bump. The project uses the bundled K2 Compose compiler (no separately pinned compose-compiler artifact to fall out of sync), so plugin versions stay aligned.
com.google.devtools.ksp	2.3.8 → 2.3.9	Patch bump, paired with the Kotlin update by Dependabot's grouping.

One caveat: this repo's CI workflows (Build Phone APK (Debug/Release)) show as skipped on this PR rather than having actually run — that's expected GitHub behavior for Dependabot PRs needing manual workflow approval, but it means there's no green build to point to yet. I'd recommend triggering/approving the CI run (or building locally) before merging, particularly to confirm the Kotlin 2.3.21 → 2.4.0 bump compiles cleanly with the Compose/serialization compiler plugins in this codebase — that's the one change in the group with the broadest blast radius even though I found no specific incompatibility.

[lostf1sh]

Claude finished @lostf1sh's task in 1m 36s —— View job

Dependency safety review

• Read the request: Duhan asked whether these 18 dependency bumps are safe to update
• Reviewed changelogs/release notes for each updated dependency for breaking changes
• Checked the actual diff and project config (app/build.gradle.kts, gradle/libs.versions.toml)
• Posted final assessment

Short answer: yes, this batch looks safe. All bumps are patch or minor releases, and I didn't find anything in this project that the documented breaking changes would touch.

Details:

Dependency Change Notes
Gradle wrapper 9.5.1 → 9.6.1 Patch release (CLI/config-cache fixes only).
JUnit Platform/Jupiter/Vintage/Params 6.1.0 → 6.1.1 Patch release, bugfixes only.
com.google.dagger:hilt-android* / com.google.dagger.hilt.android 2.59.2 → 2.60 New features + 2 "potential breaking changes": (1) Hilt Gradle plugin now errors instead of silently ignoring plugin-controlled flags — app/build.gradle.kts doesn't set any of these, so unaffected. (2) Multidex support removed, Hilt's minSdk is now 23 — this project's minSdk = 30 (app/build.gradle.kts:75), well above that, so unaffected.
io.ktor:ktor-server-*-jvm 3.5.0 → 3.5.1 Patch release. Notably includes "Fix Kotlin 2.4.0 compiler plugin breaking changes" (KTOR-9646) — i.e. this Ktor patch exists specifically to stay compatible with the Kotlin 2.4.0 bump also in this PR, which is a good sign the two were bumped together intentionally.
org.checkerframework:checker-qual 4.1.0 → 4.2.0 Transitive annotation-processing dep, minor bump.
org.jetbrains.kotlin* (android/compose/serialization plugins, kotlin-test-junit) 2.3.21 → 2.4.0 Minor Kotlin version bump. The project uses the bundled K2 Compose compiler (no separately pinned compose-compiler artifact to fall out of sync), so plugin versions stay aligned.
com.google.devtools.ksp 2.3.8 → 2.3.9 Patch bump, paired with the Kotlin update by Dependabot's grouping.
One caveat: this repo's CI workflows (Build Phone APK (Debug/Release)) show as skipped on this PR rather than having actually run — that's expected GitHub behavior for Dependabot PRs needing manual workflow approval, but it means there's no green build to point to yet. I'd recommend triggering/approving the CI run (or building locally) before merging, particularly to confirm the Kotlin 2.3.21 → 2.4.0 bump compiles cleanly with the Compose/serialization compiler plugins in this codebase — that's the one change in the group with the broadest blast radius even though I found no specific incompatibility.

can you run those checks real quick

[lostf1sh]

@claude trigger debug/release build actions

[github-actions]

Claude finished @lostf1sh's task in 53s —— View job

---

Triggering debug/release build actions

• Read the request: Duhan asked me to trigger the debug/release build CI actions on this PR
• Checked current CI status / workflow runs for this PR
• Attempted to trigger/approve the Build Phone APK (Debug/Release) workflows
• Report outcome

I wasn't able to trigger these runs.

Current status on this PR (via mcp__github_ci__get_ci_status):

Workflow	Conclusion
Build Phone APK (Debug)	skipped
Build Phone APK (Release)	skipped
Mirror to GitLab	skipped

These show as skipped because GitHub requires a maintainer to manually approve workflow runs for Dependabot PRs (first-time/automated contributors) before they execute — this happens via the "Approve and run workflows" button in the Actions tab, not via an API call I can make on your behalf.

I tried:

• The CI tools available to me (mcp__github_ci__*) only let me read run/job status and logs — there's no trigger/approve action exposed.
• Falling back to gh CLI via Bash (gh run rerun, gh workflow run, even read-only gh auth status) — all blocked, requiring interactive approval I can't grant in this automated context.

To actually run the builds, a repo maintainer needs to either:

1. Go to the Actions tab → find the pending Dependabot runs for this PR → click "Approve and run workflows", or
2. Close and reopen the PR (re-triggers workflow_run-eligible events), or
3. Push an empty commit to the branch to force a fresh run.

If you'd like me to be able to do this myself in the future, I'd need gh CLI write permissions (e.g. Bash(gh run rerun:*), Bash(gh api repos/*/actions/runs/*/approve:*)) added to my --allowedTools.
(branch: dependabot/gradle/gradle-minor-and-patch-86d307d982)