feat(deps): update gradle app major dependencies (alpha) (major)

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
io.ktor:ktor-bom	2.3.9 → 3.6.0
com.aallam.openai:openai-client	3.7.0 → 4.1.0
build.buf:protovalidate	0.2.0 → 1.3.0
com.nimbusds:nimbus-jose-jwt	9.37.3 → 10.10
com.microsoft.sqlserver:mssql-jdbc	12.6.1.jre11 → 13.6.0.jre11
net.devh:grpc-server-spring-boot-starter	2.15.0.RELEASE → 3.1.0.RELEASE
com.google.protobuf:protobuf-java-util (source)	3.25.3 → 4.36.2
org.flywaydb:flyway-core	10.10.0 → 13.7.0
org.flywaydb:flyway-database-postgresql	10.10.0 → 13.7.0
org.flywaydb.flyway	10.10.0 → 13.7.0
org.springframework.cloud:spring-cloud-starter-kubernetes-fabric8-config (source)	3.1.0 → 5.0.3
io.kotest:kotest-runner-junit5	5.8.1 → 6.2.5
io.kotest:kotest-assertions-core-jvm	5.8.1 → 6.2.5
org.springframework.boot:spring-boot-dependencies (source)	3.2.3 → 4.1.1
org.springframework.boot	3.2.3 → 4.1.1
org.jetbrains.kotlin:kotlin-gradle-plugin (source)	1.9.23 → 2.4.20
org.jetbrains.kotlin.plugin.spring	1.9.23 → 2.4.20
org.jetbrains.kotlin.jvm (source)	1.9.23 → 2.4.20

---

Release Notes

ktorio/ktor (io.ktor:ktor-bom)

v3.6.0

Compare Source

Published 16 September 2026

Features

• KTOR-8596 OpenID Connect (OAuth2) auto-discover & configuration
• KTOR-9645 Client curated multi-platform facade module
• KTOR-8883 Support nested jars in static resources
• KTOR-8672 Support at least zstd and deflate formats of precompressed files
• KTOR-8595 Auth JWK Support (auto-discover)
• KTOR-9841 OIDC Server Plugin
• KTOR-9654 Override fetch in JS engine
• KTOR-9785 Typesafe Authentication DSL
• KTOR-462 Async CIO DNS resolver with timeout
• KTOR-9709 Add resource attribute for client resources plugin
• KTOR-5009 ContentNegotiation: Add a way to prevent changing Accept and Content-Type headers
• KTOR-9776 OpenAPI: Support the "const" validation keyword
• KTOR-7468 DefaultConversionService: Support Uuid type introduced in Kotlin 2.0
• KTOR-9578 HttpCache add method for clearing
• KTOR-9590 OpenAPI Contextual JSON schema inference support
• KTOR-6610 Log which ConfigLoader has been used for loading the server configuration
• KTOR-9735 Commonize HttpCache FileCacheStorage
• KTOR-8953 WebRTC client on JVM
• KTOR-9674 UDP support for Node.js targets
• KTOR-9612 Add text/markdown to the ContentType constants

Improvements

• KTOR-9876 Typo in KDoc for routing function: "for the this Application".
• KTOR-9778 Character classification in ktor-http hot paths uses boxed Set lookups and per-symbol encoder allocations
• KTOR-9702 Duplicate code in ByteReadChannel
• KTOR-9716 Make ApplicationCallPipeline.ApplicationPhase.Validators public in 3.6.0
• KTOR-9734 Use TagConsumer in respondHtmlFragment lambda receiver
• KTOR-5577 Support nullable types in ApplicationCall.receive
• KTOR-2367 OAuth: clients expect to get authenticated once per "session" for all protected routes
• KTOR-8594 Auth: Non-optional principal is of nullable type
• KTOR-9816 Escape $ in application.yaml file
• KTOR-8193 Unnecessary blocking in OutputStream wrapper

Bugfixes

• KTOR-8705 testApplication: call coroutine context isn't preserved when responding with ChannelWriterContent
• KTOR-9248 JWTAuthenticationProvider silently swallows exceptions
• KTOR-9892 Digest Auth client: nc and qop are not handled according to RFC 7616
• KTOR-9891 CIO on Kotlin/Native collapses above ~50 connections: HttpHeadersMap pools contend on an allocating SynchronizedObject
• KTOR-9794 Digest Auth: NullPointerException when the server does not expect Digest auth
• KTOR-9788 Netty: engine double-responds after its built-in 400, crashing the call-handler coroutine with "Headers can no longer be set because response was already completed"
• KTOR-9834 HttpClient eagerly initializes SLF4J during Android startup
• KTOR-9701 Jackson/Gson converters waste time on unnecessary Dispatchers.IO dispatch
• KTOR-9832 Apache5: Upgrading Apache HttpClient5 to version 5.6 breaks the Ktor client with Content-Length mismatch error for any gzipped content
• KTOR-9870 OkHttp: Reduce coroutine dispatching and allocations while reading response bodies
• KTOR-9627 Cancel blocking bridges when coroutine is cancelled
• KTOR-7067 Ktor Cookie.parseClientCookiesHeader returns Map, which breaks Cookie header contract
• KTOR-9643 Allow H2C and HTTP/2 on same server
• KTOR-9302 OpenAPI: No way to set tag description
• KTOR-9827 Authorization header removed from refresh token request
• KTOR-8355 Bad percentage encoding in URL query causes uncaught exception and 500 status
• KTOR-9762 Android: can hang when cancelling a streaming response during a blocking read
• KTOR-9443 OpenAPI: "No mapping for symbol: VALUE_PARAMETER" exception when respondText receives a conditional ContentType within ApplicationCall extension function
• KTOR-9392 OpenAPI: "No mapping for symbol: VAR name" exception when code inference is on
• KTOR-9389 OpenAPI: "IllegalStateException: No mapping for symbol" when code inference and passing received body to HttpStatusCode()
• KTOR-9784 Multipart is not supported on non-JVM server targets
• KTOR-9657 OpenAPI: generated schema for recursive types uses invalid schemaRef with ReflectionJsonSchemaInference
• KTOR-9676 Incorrect warning about streaming compression buffering
• KTOR-9712 Netty HTTP/3: the listener can only ever serve ONE QUIC connection — every subsequent handshake times out
• KTOR-9386 Misleading log output for Unix Domain Socket servers: "Responding at unix://0.0.0.0:80"
• KTOR-8755 CIO: The engine doesn't encode Unicode symbols like '–' (U+2013) in request URL
• KTOR-9513 CharsetDecoder.decode() ignores the max argument on JVM
• KTOR-9825 Unescape quoted-pair at the end of a header parameter value
• KTOR-9731 CIO: HttpRequestLifecycle cancels Connection: close call too soon, sending an incomplete response
• KTOR-9770 CIO: mapToKtor unwraps non-timeout exceptions to their cause
• KTOR-9772 Make quality parameter case-insensitive
• KTOR-9773 OkHttp: Cancelling a request can close the response body on the Android main thread
• KTOR-7009 CIO: "Failed to parse HTTP response: unexpected EOF" when pipelining is on
• KTOR-9819 Curl: Requests leak curl_slist and response StableRef
• KTOR-9761 CIO server: request handler can leak when idle timeout cancels a claimed response
• KTOR-9817 Darwin CertificatePinner over-releases borrowed Core Foundation references
• KTOR-9774 CIO: pipelining corrupts requests with non-empty bodies
• KTOR-9766 OpenAPI: "has no continuation" AssertionError when a suspend call inside a sealed-type branch reads the smart-cast value
• KTOR-9775 OkHttp: duplex streaming does not release the connection after the request completes
• KTOR-9722 DigestAuthProvider cannot be initialized with a congested Dispatchers.Default pool
• KTOR-9739 Outdated KDoc for AuthProvider.refreshToken method
• KTOR-9792 Application lifecycle events affect other reload generations
• KTOR-9793 The new DI scope is cancelled during hot reload
• KTOR-9648 OpenAPI: reflection schema inference produces incorrect discriminator mapping for Jackson-annotated and nested sealed hierarchies
• KTOR-9760 Digest Auth: URI and HA2 are empty for a URL without a path
• KTOR-9705 OpenAPI UI (ktor-server-openapi) does not support OpenAPI spec 3.1.*
• KTOR-9715 Netty HTTP/3: user handler code is dispatched on the QUIC event loop — one blocking handler freezes the entire HTTP/3 listener (callEventGroup / pinnedCallExecutor not used)
• KTOR-2912 CORS Plugin: Access-Control-Allow-Methods header does not include default methods (GET, POST, HEAD)
• KTOR-9526 Static Content: excluded extension prevents fallback, and index file bypasses exclusion rules
• KTOR-9523 OAuth2: fallback handler not invoked when token endpoint returns invalid_grant
• KTOR-9501 Websockets: Closing WebSocketSession with a long message leads to ProtocolViolationException
• KTOR-9561 ByteReadChannel.copyTo does not propagate source closedCause on normal exit
• KTOR-9640 ktor-io reader/writer ignores autoFlush
• KTOR-9889 DI: Concurrent module loading can cause a deadlock
• KTOR-9886 Netty: inverted skippedRead CAS leaves runningLimit read-resumption broken; runningLimit = 1 deadlocks keep-alive connections

v3.5.2

Compare Source

Published 31 July 2026

Improvements

• KTOR-8032 RateLimit: Allow limit requests based on authentication result
• KTOR-9719 ApplicationCall.isStaticContent returns false when called from plugin interceptors
• KTOR-8450 ContentNegotiation: it doesn't handle content type suffixes
• KTOR-7892 SwaggerUI: Missing oauth2-redirect.html support in the plugin
• KTOR-9759 Reject whitespace in URL hosts during parsing
• KTOR-9681 Update kotlinx-io to 0.9.1
• KTOR-9743 ByteReadChannel.readLineStrict: Misleading definition of limit parameter in KDocs
• KTOR-9504 Improve KDoc for EmbeddedServer.addShutdownHook

Bugfixes

• KTOR-9741 CIO: request-handler coroutine leak on half-closed idle connection after ≥1MB response
• KTOR-7661 Maven + YAML config file does not work
• KTOR-9585 OpenAPI: JsonSchema title is truncated when it contains a dot
• KTOR-9704 UTF-8 encoding in ktor-io bypasses JVM String.getBytes intrinsics, slowing every text response by 5-7x
• KTOR-9588 SSE client (CIO engine) sends spurious Content-Length: 0 on body-less GET (RFC 9110 § 8.6 violation; rejected by AWS ELB)
• KTOR-9679 ByteReadChannel.readLine corrupts multi-byte UTF-8 by splitting a character at a buffer boundary
• KTOR-9767 ByteReadChannel.readLineTo: Return read bytes count instead of decoded characters count
• KTOR-8992 HoconConfigLoader is not loaded when ktor-server-config-yaml on the classpath
• KTOR-9698 OpenAPI: schema for kotlinx.serialization sealed types omits discriminator property in variant schemas
• KTOR-9690 Netty: in-flight requests are aborted on stop(), ignoring shutdown grace period
• KTOR-8903 Netty: Close channel connection on errors properly
• KTOR-9707 SaveBody performance regression
• KTOR-9703 Inefficient text reading function in DefaultTransform
• KTOR-9711 Netty HTTP/2: a single client-canceled stream (RST_STREAM) breaks response flushing for the whole connection
• KTOR-9688 RateLimit: No access to principal when wrapped with authentication since 3.5.1
• KTOR-9677 Auto-reloading: server is reloaded only once since 3.5.0
• KTOR-9683 Sockets: Canceling a SelectorManager job doesn't close it properly
• KTOR-9671 Darwin: Semicolons in URL path are sanitized

v3.5.1

Compare Source

Published 25 June 2026

Improvements

• KTOR-9492 OpenAPI plugin: handle requireXxx functions in compiler plugin
• KTOR-9569 Add more details for KDoc of BearerAuthConfig.sendWithoutRequest
• KTOR-9571 Add KDoc for BearerAuthConfig.realm
• KTOR-9570 Add Kdoc for BearerAuthConfig.refreshTokens

Bugfixes

• KTOR-9646 Fix Kotlin 2.4.0 compiler plugin breaking changes
• KTOR-9585 OpenAPI: JsonSchema title is truncated when it contains a dot
• KTOR-9591 OpenAPI: @JsonClassDiscriminator on sealed types is ignored when generating OpenAPI discriminator schema
• KTOR-9597 OpenAPI: Schema name collisions because@SerialName of sealed subtypes is used as components.schemas key
• KTOR-9601 OpenAPI: nullable @​JvmInline value class loses nullability in generated schema
• KTOR-9620 Some issues related to digest authentication in 3.5.0
• KTOR-9623 Digest Auth: server must respond with one WWW-Authenticate header for each supported algorithm
• KTOR-9624 Digest Auth: "Unsupported charset in digest authentication header" for a charset name in lowercase
• KTOR-9630 Digest Auth: The plugin sends incorrect nonce when server responds with multiple WWW-Authenticate headers
• KTOR-9565 WebRTC: Peer stops receiving messages after a while on iOS
• KTOR-9610 WebRtcPeerConnection::close causes ClosedReceiveChannelException for other peer
• KTOR-9633 WebRTC statistics fetching race condition
• KTOR-9603 Structured concurrency is violated in WebRTC tests
• KTOR-9671 Darwin: Semicolons in URL path are sanitized
• KTOR-9639 Darwin: WebSocket client crashes the process when a PONG arrives after the session is closed
• KTOR-9575 Darwin: findCharset("UTF-16") maps to NSUTF16LittleEndianStringEncoding causing decoding failure for UTF-16 content with BOM
• KTOR-9661 HttpCache: InvalidCacheStateException is thrown on 304 when no cached entry matches varyKeys
• KTOR-9673 Caching always missing with Content Negotiation
• KTOR-9596 HttpTimeout: HttpRequestTimeoutException on any request with runTest and request timeout defined since 3.5.0
• KTOR-9632 HttpRequestBuilder.timeout call removes capabilities set in DefaultRequest
• KTOR-9252 ContentEncoding: Incomplete gzip response causes client/server to hang indefinitely
• KTOR-9670 Compression: The plugin ignores Accept-Encoding q=0 and most-specific matching
• KTOR-9614 Zstd Compression: "Destination buffer is too small" exception for a particular sequence of bytes
• KTOR-9636 CORS plugin drops OPTIONS preflight requests when allowSameOrigin is on
• KTOR-9659 CORS is skipped when the Origin header contains an IPv6 address
• KTOR-9574 ContentNegotiation: The charset of Accept-Charset header is used for response deserialization
• KTOR-9606 KotlinxSerializationConverter: it fails to deserialize an empty channel closed with a delay
• KTOR-9617 OutputStreamContent and WriterContent can exhaust Dispatchers.IO
• KTOR-9629 RawSourceChannel: coroutine cancellation is not propagated to the RawSource
• KTOR-8870 File.readChannel: do not close a non-opened file and ignore closing exceptions
• KTOR-9460 Curl: Can't build shared library with Ktor 3.4.2
• KTOR-9607 Crash on Android 7: NoSuchMethodError getInstanceStrong() since 3.5.0
• KTOR-9595 CIO: The engine imports node:net statically and breaks wasmJsBrowser webpack build
• KTOR-9615 Apache5: The underlying request is not aborted when coroutine Job is cancelled
• KTOR-8443 RoutingBuilder.contentType does not use parameters when matching
• KTOR-9425 SessionTransportTransformerEncrypt init block uses wrong IV size for AES-256 (regression of KTOR-661)
• KTOR-9621 RateLimit plugin is bypassed when the nested authenticate block rejects the request
• KTOR-8766 DI: The close method is called twice on cleanup of AutoCloseable
• KTOR-8695 GMTDate() being offset by 369 years on Windows
• KTOR-9589 Duplicate PROPERTY_SETTER target in @​InternalAPI annotation
• KTOR-9602 Gradle plugin environment variable is not included in the image

v3.5.0

Compare Source

Published 14 May 2026

Features

• KTOR-8421 Route.contentType should support multiple ContentType
• KTOR-7961 Add known TDM headers to the HttpHeaders object
• KTOR-9418 Support getAs from the root ApplicationConfig
• KTOR-9559 DNS configuration for the Apache5 client
• KTOR-9554 DNS configuration for OkHttp client engine
• KTOR-9555 Custom SSE heartbeat function
• KTOR-8914 Dependency injection: read annotations in function references
• KTOR-8300 Sessions: Add a way to create a user session shared for all user devices or look up sessions of the same user
• KTOR-9521 Upgrade to Kotlin 2.3.21
• KTOR-9276 Make DynamicProviderConfig.authenticateFunction suspend
• KTOR-9491 Provide parameter validation convenience functions
• KTOR-9506 OpenAPI: Support prefixItems in JsonSchema for tuple type definitions
• KTOR-470 Add an option to not resend the session cookie if the session data wasn't changed.
• KTOR-9355 Deprecate HttpHeaders.AcceptCharset
• KTOR-7659 Make ktor-network compatible with ES modules for nodejs
• KTOR-9350 JS: Make ES2015 the default target for tests
• KTOR-7578 Update Digest authentication implementation according to RFC 7616

Improvements

• KTOR-9503 The JacksonConverter.streamRequestBody property name is confusing
• KTOR-9552 Deprecation notice for io.ktor.server.auth.Principal does not explain what to use instead
• KTOR-7458 Jetty Jakarta: Provide an easy way to disable SNI hostname validation
• KTOR-9354 Websockets: webSocket builder function should return a Route to be describable
• KTOR-9488 Nonce and hex function performance optimizations

Bugfixes

• KTOR-9524 Netty response hangs after connection lost
• KTOR-9542 Netty: The request handler runs on worker event loop instead of call event loop since 3.4.3
• KTOR-9531 Netty server intermittently drops requests after upgrading to 3.4.3
• KTOR-8151 MicrometerMetrics: "MeterFilters configured after a Meter has been registered" warning when a metric is registered before installing the plugin
• KTOR-9411 Darwin throws DarwinHttpRequestException instead of FrameTooBigException
• KTOR-8320 CallLogging: plugin usage in testApplication breaks console standard output
• KTOR-8906 Jackson, with request body streaming on, exhausts Dispatchers.IO
• KTOR-8709 Websockets: Unable to close session with a custom CloseReason
• KTOR-9567 Flaky UnixSockets on Windows: WSAEOPNOTSUPP from bind()
• KTOR-9183 A client call wrapped with withTimeout throws a generic CancellationException instead of TimeoutCancellationException
• KTOR-8199 Autoreloading: default watch patterns don't match anything when project path contain spaces
• KTOR-9549 Kotlin/JS: ktor-ktor-client-core.mjs is incompatible with Vite: toRaw naming conflict
• KTOR-9544 Apache: body channel not cancelled when caller scope is cancelled
• KTOR-9546 HttpClient: cancelling ByteReadChannel body does not propagate to engine
• KTOR-455 Content-Disposition additional parameters should be inside quotes
• KTOR-9500 RawSourceChannel returns false positive on awaitContent
• KTOR-646 Netty engine still print annoying exceptions
• KTOR-9527 Curl: Freeze when receiving large responses
• KTOR-9460 Curl: Can't build shared library with Ktor 3.4.2
• KTOR-9483 Curl: backpressure implementation is never used
• KTOR-9545 Curl: body channel not cancelled when caller scope is cancelled
• KTOR-9540 Curl: CancelWebSocket task may cancel a new HTTP request due to easy handle pointer reuse
• KTOR-9539 Curl: WebSocket bearer token refresh fails due to stale native handle reuse
• KTOR-9536 Netty call hang when channel becomes inactive before response is sent
• KTOR-4752 OkHttp: Websockets pinging doesn't work
• KTOR-9409 call.respond performance regression caused by transitive kotlin-reflect:2.3.0
• KTOR-9487 ZSTD decoder fails if the compressed frame is larger than 4096 bytes
• KTOR-8271 MockEngine, HttpTimeout: the virtual clock of kotlinx coroutines isn't respected
• KTOR-6683 Plugin onCallReceive/transformBody is not called for receive()
• KTOR-7416 Jetty, Java: Custom Host header doesn't override the default value
• KTOR-9203 CIOMultipartDataBase: Call thread is blocked when releasing file parts

v3.4.3

Compare Source

Published 22 April 2026

Bugfixes

• KTOR-9451 OpenAPI schema inference not working for custom nested generics
• KTOR-9490 OpenAPI: Self-referential schema $ref uses FQN while schema is registered with a simple name
• KTOR-9463 OpenAPI: schema inference StackOverflow
• KTOR-8938 WebSockets: WebSockets handler does not inherit server coroutine context
• KTOR-8989 Shared engine is closed when a client created with config method is closed
• KTOR-9485 Apache5: FutureCallback never called, breaking Java agent instrumentation
• KTOR-9497 Darwin: SIGABRT crash when close() races with in-flight execute() since 3.4.2
• KTOR-9431 SuspendFunctionGun: ThreadContextElement leaks across requests when interceptor suspends
• KTOR-9423 CannotTransformContentToTypeException leaks internal class names in response body
• KTOR-9461 Incorrect link to the OWASP cheatsheet in the KDoc for CSRF plugin
• KTOR-9476 Unable to update/remove session data if no response content
• KTOR-9343 HttpRequestLifecycle plugin with cancelCallOnClose on, cancels subsequent requests when CallLogging plugin with callIdMdc is installed

v3.4.2

Compare Source

Published 27 March 2026

Improvements

• KTOR-9327 Curl: The WebSockets maxFrameSize option does not have an effect
• KTOR-9383 CaseInsensitiveString: reduce allocations
• KTOR-9385 Netty: Allocation micro-optimizations
• KTOR-9403 Darwin: Unnecessary ByteArray copy for each received response chunk
• KTOR-9412 KDoc for formFieldLimit documents incorrect default value (64 KB instead of 50 MiB)

Bugfixes

• KTOR-9351 OpenAPI: Incorrect schema generated for nested classes with lists
• KTOR-9361 WebSockets: JsWebSocketSession._closeReason is completed twice
• KTOR-9437 Fix GraalVM Compatibility
• KTOR-9424 Logging: OkHttp format should log the full requested URL
• KTOR-8540 Logging: IllegalStateException is thrown when response is cached and deserialization fails
• KTOR-9370 OpenAPI: NoSuchMethodError - getLOCAL_FUNCTION_FOR_LAMBDA with Kotlin 2.3.20-*
• KTOR-9421 Netty: active SSE connection blocks HTTP/2 response flushing for other requests
• KTOR-3390 JS browser: "Failed to execute 'digest' on 'SubtleCrypto'" error when using digest auth
• KTOR-5977 Compression: The encoders buffer streaming response
• KTOR-9393 Certificate pinning matches against all pins instead of hostname-scoped pins
• KTOR-8751 DI: AmbiguousDependencyException when named dependency is overridden in testApplication
• KTOR-9039 Bearer Auth: Request body transformed with jsonIO isn't sent over again after refreshToken request
• KTOR-9404 Darwin: Memory leak in KtorNSURLSessionDelegate
• KTOR-9399 LinkageError when running Ktor app with development mode inside Spring Boot / Amper fat-JAR
• KTOR-9402 NoSuchMethodError on RawWebSocket after 3.4.0
• KTOR-9372 Frame.Text.readText() causes infinite loop and 100% CPU on Kotlin/Native when WebSocket frame data is malformed or connection drops unexpectedly
• KTOR-9387 ZstdEncoder decode fails when source data is split into multiple Zstd frames

v3.4.1

Compare Source

Published 3 March 2026

Improvements

• KTOR-9382 HttpProtocolVersion.parse: fast path for common versions
• KTOR-9381 GMTDate: reduce allocations
• KTOR-8971 Support "operationId" in Kdoc for OpenAPI spec. gen.
• KTOR-9333 WebSockets: Infinite spin and potential OOM vulnerabilities in the Inflater.inflateFully method
• KTOR-5616 Ktor always adds by default an Accept-Charset header
• KTOR-9291 OpenAPI: handle atypical route functions
• KTOR-9293 OpenAPI describe needs defaults
• KTOR-9304 OpenAPI: Order of path parameters is not preserved in the spec
• KTOR-9353 Routing: TailcardSelector missing toString(), which clutters the logs

Bugfixes

• KTOR-9281 OpenApi code inference misses lambda argument bodies
• KTOR-9273 OpenAPI static content path appears in resulting model
• KTOR-9004 OpenAPI: No respective formats detected for serializable types like UUID or Instant
• KTOR-9305 OpenAPI: "No mapping for symbol: VAR FOR_LOOP_VARIABLE" error with codeInferenceEnabled=true
• KTOR-9279 OpenAPI: UnsupportedOperationException for a function with a reified type parameter codeInferenceEnabled = true
• KTOR-9289 OpenAPI: Resource routes are missing inferred and comment-based documentation
• KTOR-9330 OpenAPI: Cannot override kotlinx.serialization module
• KTOR-9320 OpenAPI: jsonSchema() does not unwrap Kotlin value classes (inline classes)
• KTOR-9352 Authentication: Creating JWT verifier fails for JWK with kty=EC and alg=null
• KTOR-9344 Flow invariant error happens after update to Ktor 3.4.0
• KTOR-9362 testApplication: Race condition in timeout coroutine when response is streaming
• KTOR-9274 Curl: Undefined symbol errors when linking on Linux since 3.4.0
• KTOR-8782 NodeJS CIO: "Module 'os' could not be imported" error on resolving WORKING_DIRECTORY_PATH with es2015 target
• KTOR-9348 String.decodeBase64String fails to decode when the input has no padding since 3.4.0
• KTOR-9318 CIO engine rejects valid certificates with unsupported signature algorithms
• KTOR-9331 Curl: Segfaults when working with WebSockets
• KTOR-9334 Coroutines in route handlers are dispatched with Dispatchers.Unconfined since 3.2.0
• KTOR-9339 StreamResetException is not propagated to the caller of StreamRequestBody.writeTo since 3.4.0
• KTOR-9329 HTMX: "on" attributes extension not working
• KTOR-9316 WasmJS bad get and set implementations for Uint8Array and ArrayLike
• KTOR-9272 JSON schema inference does not recognize unsigned types
• KTOR-9211 SendCountExceedException when request is sent twice with maxRetries = 0 since 3.3.2
• KTOR-9285 RateLimit: Milliseconds in the Retry-After header are truncated
• KTOR-7512 JWT: Docs for validate method claim that it's optional, but it isn't
• KTOR-9269 Incorrect dependency declaration in swagger / openapi
• KTOR-9372 Frame.Text.readText() causes infinite loop and 100% CPU on Kotlin/Native when WebSocket frame data is malformed or connection drops unexpectedly

v3.4.0

Compare Source

Published 22 January 2026

Features

• KTOR-8316 Support OpenAPI specification for the Ktor Client and Server Application
  • KTOR-9085 Read OpenAPI security details from authentication plugin
  • KTOR-8993 Use runtime-generated spec for OpenAPI / Swagger plugins
  • KTOR-9086 Read OpenAPI default content type information from ContentNegotiation plugin
  • KTOR-8859 Routing documentation compiler plugin
  • KTOR-8936 Routing documentation runtime API
  • KTOR-9087 Generate JSON schema for type references when using Jackson and Gson
• KTOR-7075 Zstd support
• KTOR-9209 Support Jackson 3
• KTOR-9198 Auth/Bearer: Make BearerAuthProvider detect disguised Bearer scheme
• KTOR-8927 Support for respondResource
• KTOR-9162 Auth API key plugin
• KTOR-7882 Support HTTP QUERY method
• KTOR-8195 Partial HTML response
• KTOR-8985 EngineMain: Support reading trust store settings from the configuration
• KTOR-9066 Add duplex streaming for OkHttpClient
• KTOR-8180 Auth: Provide control over tokens to user code
• KTOR-8273 iOS native interop for WebRTC client
• KTOR-8956 DI: Allow file configuration
• KTOR-9157 Support SIGINT on web and SIGTERM on Native

Improvements

• KTOR-8890 Rename target jsAndWasmShared to web
• KTOR-9242 Upgrade to Kotlin 2.3
• KTOR-9243 Update libcurl to 8.18.0
• KTOR-9014 Deprecate DarwinLegacy engine
• KTOR-8931 Test iOS target of the WebRTC Client in Ktor-Chat
• KTOR-9199 Make HttpHeaders strings const
• KTOR-9208 Expose plusIsSpace in parseUrlEncodedParameters
• KTOR-2404 Ktor Oauth2 feature sends 401 response when the client secret is invalid
• KTOR-9097 Java: Use HTTP/2 by default
• KTOR-8740 HTMX: Missing DSL for some attributes
• KTOR-9171 Redesign ByteReadChannel.readUTF8Line API
• KTOR-4219 Make readUTF8LineTo return number of read symbols instead of boolean
• KTOR-6761 Apache5: Simplify configuration of ConnectionManager
• KTOR-9037 Multipart/form-data: Make formData's block inline
• KTOR-9126 Missing function ByteReadChannel.readTo(sink: RawSink, byteCount: Long)
• KTOR-9026 Introduce/reuse interfaces for logging selectors
• KTOR-6766 Deprecate Apache 4 engine
• KTOR-8642 Excessive memory allocations while writing bytes into write channel of TCP/IP socket
• KTOR-9137 ByteReadChannel.readUTF8Line is inefficient for long lines
• KTOR-8657 Remove kotlinx-datetime from ktor-server-default-headers dependencies
• KTOR-8941 Add override DI conflict policy

Bugfixes

• KTOR-9258 headers { } block does not affect the request in defaultRequest due to function name collision with io.ktor.http.headers
• KTOR-9235 HttpCookies: Support parsing non-compilant Expires dates of Set-Cookie header
• KTOR-8945 ByteReadChannel.readUTF8Line doesn't throw TooLongLineException when the limit is reached
• KTOR-8339 Curl: caPath is not set by default in the Curl client on linuxArm64
• KTOR-9188 WebRTC. IceServer.urls should be a list.
• KTOR-9148 Logging: Body logging of multipart/form-data requests hangs when OkHttp format is on
• KTOR-9166 CORS: Excessive logs on INFO level since 3.3.3
• KTOR-9130 Missing implementation of getPluginId method error with Kotlin 2.3.0-RC
• KTOR-9147 OpenAPI: "AssertionError: Cannot add a performance m

❗ Important

✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.