chore(deps): bump the kotlin-minor-patch group across 1 directory with 12 updates

[dependabot]

Bumps the kotlin-minor-patch group with 5 updates in the / directory:

Package	From	To
org.jetbrains.kotlinx:kotlinx-coroutines-core	1.8.0	1.10.2
org.jetbrains.kotlinx:kotlinx-serialization-json	1.7.0	1.11.0
io.ktor:ktor-client-core	3.0.0	3.4.3
jvm	2.0.0	2.3.21
plugin.serialization	2.0.0	2.3.21

Updates org.jetbrains.kotlinx:kotlinx-coroutines-core from 1.8.0 to 1.10.2

Release notes

Sourced from org.jetbrains.kotlinx:kotlinx-coroutines-core's releases.

1.10.2

• Fixed the kotlinx-coroutines-debug JAR file including the module-info.class file twice, resulting in failures in various tooling (#4314). Thanks, @​RyuNen344!
• Fixed Flow.stateIn hanging when the scope is cancelled in advance or the flow is empty (#4322). Thanks, @​francescotescari!
• Improved handling of dispatcher failures in .limitedParallelism (#4330) and during flow collection (#4272).
• Fixed runBlocking failing to run its coroutine to completion in some cases if its JVM thread got interrupted (#4399).
• Small tweaks, fixes, and documentation improvements.

1.10.1

• Fixed binary incompatibility introduced for non-JVM targets in #4261 (#4309).

1.10.0

• Kotlin was updated to 2.1.0 (#4284).
• Introduced Flow.any, Flow.all, and Flow.none (#4212). Thanks, @​CLOVIS-AI!
• Reorganized kotlinx-coroutines-debug and kotlinx-coroutines-core code to avoid a split package between the two artifacts (#4247). Note that directly referencing kotlinx.coroutines.debug.AgentPremain must now be replaced with kotlinx.coroutines.debug.internal.AgentPremain. Thanks, @​sellmair!
• No longer shade byte-buddy in kotlinx-coroutines-debug, reducing the artifact size and simplifying the build configuration of client code. Thanks, @​sellmair!
• Fixed NullPointerException when using Java-deserialized kotlinx-coroutines-core exceptions (#4291). Thanks, @​AlexRiedler!
• Properly report exceptions thrown by CoroutineDispatcher.dispatch instead of raising internal errors (#4091). Thanks, @​zuevmaxim!
• Fixed a bug that delayed scheduling of a Dispatchers.Default or Dispatchers.IO task after a yield() in rare scenarios (#4248).
• Fixed a bug that prevented the main() coroutine on Wasm/WASI from executing after a delay() call in some scenarios (#4239).
• Fixed scheduling of runBlocking tasks on Kotlin/Native that arrive after the runBlocking block was exited (#4245).
• Fixed some terminal Flow operators sometimes resuming without taking cancellation into account (#4254). Thanks, @​jxdabc!
• Fixed a bug on the JVM that caused coroutine-bound ThreadLocal values not to get cleaned when using non-CoroutineDispatcher continuation interceptors (#4296).
• Small tweaks, fixes, and documentation improvements.

1.9.0

Features

• Wasm/WASI target support (#4064). Thanks, @​igoriakovlev!
• limitedParallelism now optionally accepts the name of the dispatcher view for easier debugging (#4023).
• No longer initialize Dispatchers.IO on the JVM when other standard dispatchers are accessed (#4166). Thanks, @​metalhead8816!
• Introduced the Flow<T>.chunked(size: Int): Flow<List<T>> operator that groups emitted values into groups of the given size (#1290).
• Closeable dispatchers are instances of AutoCloseable now (#4123).

Fixes

• Calling hasNext on a Channel's iterator is idempotent (#4065). Thanks, @​gitpaxultek!
• CoroutineScope() created without an explicit dispatcher uses Dispatchers.Default on Native (#4074). Thanks, @​whyoleg!
• Fixed a bug that prevented non-Android Dispatchers.Main from initializing when the Firebase dependency is used (#3914).
• Ensured a more intuitive ordering of tasks in runBlocking (#4134).
• Forbid casting a Mutex to Semaphore (#4176).
• Worked around a stack overflow that may occur when calling asDeferred on a Future many times (#4156).

Deprecations and promotions

• Advanced the deprecation levels for BroadcastChannel-based API (#4197).
• Advanced the deprecation levels for the old kotlinx-coroutines-test API (#4198).
• Deprecated Job.cancelFutureOnCompletion (#4173).
• Promoted CoroutineDispatcher.limitedParallelism to stable (#3864).
• Promoted CoroutineStart.ATOMIC from ExperimentalCoroutinesApi to DelicateCoroutinesApi (#4169).
• Promoted CancellableContinuation.resume with an onCancellation lambda to stable, providing extra arguments to the lambda (#4088).

... (truncated)

Changelog

Sourced from org.jetbrains.kotlinx:kotlinx-coroutines-core's changelog.

Version 1.10.2

• Fixed the kotlinx-coroutines-debug JAR file including the module-info.class file twice, resulting in failures in various tooling (#4314). Thanks, @​RyuNen344!
• Fixed Flow.stateIn hanging when the scope is cancelled in advance or the flow is empty (#4322). Thanks, @​francescotescari!
• Improved handling of dispatcher failures in .limitedParallelism (#4330) and during flow collection (#4272).
• Fixed runBlocking failing to run its coroutine to completion in some cases if its JVM thread got interrupted (#4399).
• Small tweaks, fixes, and documentation improvements.

Version 1.10.1

• Fixed binary incompatibility introduced for non-JVM targets in #4261 (#4309).

Version 1.10.0

• Kotlin was updated to 2.1.0 (#4284).
• Introduced Flow.any, Flow.all, and Flow.none (#4212). Thanks, @​CLOVIS-AI!
• Reorganized kotlinx-coroutines-debug and kotlinx-coroutines-core code to avoid a split package between the two artifacts (#4247). Note that directly referencing kotlinx.coroutines.debug.AgentPremain must now be replaced with kotlinx.coroutines.debug.internal.AgentPremain. Thanks, @​sellmair!
• No longer shade byte-buddy in kotlinx-coroutines-debug, reducing the artifact size and simplifying the build configuration of client code. Thanks, @​sellmair!
• Fixed NullPointerException when using Java-deserialized kotlinx-coroutines-core exceptions (#4291). Thanks, @​AlexRiedler!
• Properly report exceptions thrown by CoroutineDispatcher.dispatch instead of raising internal errors (#4091). Thanks, @​zuevmaxim!
• Fixed a bug that delayed scheduling of a Dispatchers.Default or Dispatchers.IO task after a yield() in rare scenarios (#4248).
• Fixed a bug that prevented the main() coroutine on Wasm/WASI from executing after a delay() call in some scenarios (#4239).
• Fixed scheduling of runBlocking tasks on Kotlin/Native that arrive after the runBlocking block was exited (#4245).
• Fixed some terminal Flow operators sometimes resuming without taking cancellation into account (#4254). Thanks, @​jxdabc!
• Fixed a bug on the JVM that caused coroutine-bound ThreadLocal values not to get cleaned when using non-CoroutineDispatcher continuation interceptors (#4296).
• Small tweaks, fixes, and documentation improvements.

Version 1.9.0

Features

• Wasm/WASI target support (#4064). Thanks, @​igoriakovlev!
• limitedParallelism now optionally accepts the name of the dispatcher view for easier debugging (#4023).
• No longer initialize Dispatchers.IO on the JVM when other standard dispatchers are accessed (#4166). Thanks, @​metalhead8816!
• Introduced the Flow<T>.chunked(size: Int): Flow<List<T>> operator that groups emitted values into groups of the given size (#1290).
• Closeable dispatchers are instances of AutoCloseable now (#4123).

Fixes

• Calling hasNext on a Channel's iterator is idempotent (#4065). Thanks, @​gitpaxultek!
• CoroutineScope() created without an explicit dispatcher uses Dispatchers.Default on Native (#4074). Thanks, @​whyoleg!
• Fixed a bug that prevented non-Android Dispatchers.Main from initializing when the Firebase dependency is used (#3914).
• Ensured a more intuitive ordering of tasks in runBlocking (#4134).
• Forbid casting a Mutex to Semaphore (#4176).
• Worked around a stack overflow that may occur when calling asDeferred on a Future many times (#4156).

Deprecations and promotions

• Advanced the deprecation levels for BroadcastChannel-based API (#4197).
• Advanced the deprecation levels for the old kotlinx-coroutines-test API (#4198).

... (truncated)

Commits

• 5f89004 Version 1.10.2
• 1a8de2e Merge remote-tracking branch 'origin/master' into develop
• e9b247e Advertise source jars for JVM-only libraries (#4394)
• 6baf7c8 Restore Android compatibility in Executor.asCoroutineDispatcher (#4396)
• dbca4c1 Reliably run finalizers even if runBlocking got interrupted. (#4399)
• 45893ce Add the issue template for guide-related problems (#4386)
• 8627cc3 Fix an explanation of flow emit (#4391)
• 5f8035c Specify explicit return types for some public API functions (#4389)
• 465e29d Set a predefined image width in debug-coroutines-with-idea.md (#4377)
• 96de301 Simplify newFixedThreadPoolContext using apply and remove unused import (#4378)
• Additional commits viewable in compare view

Updates org.jetbrains.kotlinx:kotlinx-serialization-json from 1.7.0 to 1.11.0

Release notes

Sourced from org.jetbrains.kotlinx:kotlinx-serialization-json's releases.

1.11.0

This release is based on Kotlin 2.3.20 and provides a new Json exceptions API and some bugfixes and improvements.

Expose Json exceptions structure

To make working with exceptions easier and providing proper error codes in e.g., REST APIs, classes JsonException, JsonDecodingException, and JsonEncodingException are now public. They have relevant public properties, such as shortMessage, path, offset, and others. This API is currently experimental, and we're going to improve it further in the subsequent releases. See the linked issues for the details: #1930, #1877.

Ability to hide user input from exception messages for security/privacy reasons.

Historically, exception messages in kotlinx.serialization often included the input Json itself for debuggability reason. Such behavior may pose additional challenges for logging, analytics, and other systems, since a system is not always allowed to store user data due to privacy/security reasons, which imposes additional sanitation logic. To address this issue, a new property exceptionsWithDebugInfo is added to JsonConfiguration. Disable it to hide user input from exception messages. IMPORTANT: This behavior will be enabled by default when this property becomes stable. See #2590 for more details.

Bugfixes and improvements

• CBOR: Relax value range check when decoding numbers (#3167)
• Use a specialized writeDecimalLong method for IO stream integrations in Json (#3152)

1.10.0

This release is based on Kotlin 2.3.0 and contains all of the changes from 1.10.0-RC. The only additional change is a fix for ProtoBuf packing of Kotlin unsigned types (#3079). Big thanks to KosmX for contributing the fix.

For your convenience, the changelog for 1.10.0-RC is duplicated below:

Stabilization of APIs

kotlinx-serialization 1.10 and subsequent releases will be focused on stabilization of existing APIs. The following APIs and configuration options are no longer experimental because they're widely used without any known major issues:

• Json configuration options: decodeEnumsCaseInsensitive, allowTrailingComma, allowComments, and prettyPrintIndent. (#3100)
• @EncodeDefault annotation and its modes. (#3106)
• JsonUnquotedLiteral constructor function (#2900)
• JsonPrimitive constructor function overloads that accept unsigned types. (#3117)
• JSON DSL functions on JsonElement with Nothing? overloads. (#3117)

Readiness for return value checker

Kotlin 2.3.0 introduces a new feature aimed at helping you to catch bugs related to the accidentally ignored return value of the function. kotlinx-serialization 1.10.0-RC code is fully marked for this feature, meaning that you can get warnings for unused function calls like Json.encodeToString(...). To get the warnings, the feature has to be enabled in your project as described here.

Polymorphism improvements

... (truncated)

Changelog

Sourced from org.jetbrains.kotlinx:kotlinx-serialization-json's changelog.

1.11.0 / 2026-04-10

This release is based on Kotlin 2.3.20 and provides new Json exceptions API and some bugfixes and improvements.

Expose Json exceptions structure

To make working with exceptions easier and providing proper error codes in e.g., REST APIs, classes JsonException, JsonDecodingException, and JsonEncodingException are now public. They have relevant public properties, such as shortMessage, path, offset, and others. This API is currently experimental, and we're going to improve it further in the subsequent releases. See the linked issues for the details: #1930, #1877.

Ability to hide user input from exception messages for security/privacy reasons.

Historically, exception messages in kotlinx.serialization often included the input Json itself for debuggability reason. Such behavior may pose additional challenges for logging, analytics, and other systems, since a system is not always allowed to store user data due to privacy/security reasons, which imposes additional sanitation logic. To address this issue, a new property exceptionsWithDebugInfo is added to JsonConfiguration. Disable it to hide user input from exception messages. IMPORTANT: This behavior will be enabled by default when this property becomes stable. See #2590 for more details.

Bugfixes and improvements

• CBOR: Relax value range check when decoding numbers (#3167)
• Use a specialized writeDecimalLong method for IO stream integrations in Json (#3152)

1.10.0 / 2026-01-21

This release is based on Kotlin 2.3.0 and contains all of the changes from 1.10.0-RC. The only additional change is a fix for ProtoBuf packing of Kotlin unsigned types (#3079). Big thanks to KosmX for contributing the fix.

For your convenience, the changelog for 1.10.0-RC is duplicated below:

Stabilization of APIs

kotlinx-serialization 1.10 and subsequent releases will be focused on stabilization of existing APIs. The following APIs and configuration options are no longer experimental because they're widely used without any known major issues:

• Json configuration options: decodeEnumsCaseInsensitive, allowTrailingComma, allowComments, and prettyPrintIndent. (#3100)
• @EncodeDefault annotation and its modes. (#3106)
• JsonUnquotedLiteral constructor function (#2900)
• JsonPrimitive constructor function overloads that accept unsigned types. (#3117)
• JSON DSL functions on JsonElement with Nothing? overloads. (#3117)

Readiness for return value checker

... (truncated)

Commits

• 6956af2 Prepare 1.11 release
• 390d84c Merge remote-tracking branch 'origin/master' into dev
• 431fe2d Use local repo for publishing (#3171)
• 05c12b6 Add usage attribute to "testRepositories" configuration
• a4e1f08 Bump Kover version to 0.9.8 release (#3174)
• 304e858 Expose Json exceptions structure (#3145)
• 4a0338e Included G Play SDK verification file for core-jvm (#3169)
• 421f64c CBOR: Relax value range check when decoding numbers (#3167)
• 85a4f12 KT-84955: mark apple x64 tagets as deprecated error
• bd38b0e Remove dead code
• Additional commits viewable in compare view

Updates io.ktor:ktor-client-core from 3.0.0 to 3.4.3

Release notes

Sourced from io.ktor:ktor-client-core's releases.

3.4.3

Published 22 April 2026

Bugfixes

• KTOR-9451 OpenAPI schema inference not working for custom nested generics
• KTOR-9490 OpenAPI: Self-referential schema $ref uses FQN while schema is registered with a simple name
• KTOR-9463 OpenAPI: schema inference StackOverflow
• KTOR-8938 WebSockets: WebSockets handler does not inherit server coroutine context
• KTOR-8989 Shared engine is closed when a client created with config method is closed
• KTOR-9485 Apache5: FutureCallback never called, breaking Java agent instrumentation
• KTOR-9497 Darwin: SIGABRT crash when close() races with in-flight execute() since 3.4.2
• KTOR-9431 SuspendFunctionGun: ThreadContextElement leaks across requests when interceptor suspends
• KTOR-9423 CannotTransformContentToTypeException leaks internal class names in response body
• KTOR-9461 Incorrect link to the OWASP cheatsheet in the KDoc for CSRF plugin
• KTOR-9476 Unable to update/remove session data if no response content
• KTOR-9343 HttpRequestLifecycle plugin with cancelCallOnClose on, cancels subsequent requests when CallLogging plugin with callIdMdc is installed

3.4.2

Published 27 March 2026

Improvements

• KTOR-9327 Curl: The WebSockets maxFrameSize option does not have an effect
• KTOR-9383 CaseInsensitiveString: reduce allocations
• KTOR-9385 Netty: Allocation micro-optimizations
• KTOR-9403 Darwin: Unnecessary ByteArray copy for each received response chunk
• KTOR-9412 KDoc for formFieldLimit documents incorrect default value (64 KB instead of 50 MiB)

Bugfixes

• KTOR-9351 OpenAPI: Incorrect schema generated for nested classes with lists
• KTOR-9361 WebSockets: JsWebSocketSession._closeReason is completed twice
• KTOR-9437 Fix GraalVM Compatibility
• KTOR-9424 Logging: OkHttp format should log the full requested URL
• KTOR-8540 Logging: IllegalStateException is thrown when response is cached and deserialization fails
• KTOR-9370 OpenAPI: NoSuchMethodError - getLOCAL_FUNCTION_FOR_LAMBDA with Kotlin 2.3.20-*
• KTOR-9421 Netty: active SSE connection blocks HTTP/2 response flushing for other requests
• KTOR-3390 JS browser: "Failed to execute 'digest' on 'SubtleCrypto'" error when using digest auth
• KTOR-5977 Compression: The encoders buffer streaming response
• KTOR-9393 Certificate pinning matches against all pins instead of hostname-scoped pins
• KTOR-8751 DI: AmbiguousDependencyException when named dependency is overridden in testApplication
• KTOR-9039 Bearer Auth: Request body transformed with jsonIO isn't sent over again after refreshToken request
• KTOR-9404 Darwin: Memory leak in KtorNSURLSessionDelegate
• KTOR-9399 LinkageError when running Ktor app with development mode inside Spring Boot / Amper fat-JAR
• KTOR-9402 NoSuchMethodError on RawWebSocket after 3.4.0
• KTOR-9372 Frame.Text.readText() causes infinite loop and 100% CPU on Kotlin/Native when WebSocket frame data is malformed or connection drops unexpectedly
• KTOR-9387 ZstdEncoder decode fails when source data is split into multiple Zstd frames

3.4.1

Published 3 March 2026

Improvements

... (truncated)

Changelog

Sourced from io.ktor:ktor-client-core's changelog.

3.4.3

Published 22 April 2026

Bugfixes

• KTOR-9451 OpenAPI schema inference not working for custom nested generics
• KTOR-9490 OpenAPI: Self-referential schema $ref uses FQN while schema is registered with a simple name
• KTOR-9463 OpenAPI: schema inference StackOverflow
• KTOR-8938 WebSockets: WebSockets handler does not inherit server coroutine context
• KTOR-8989 Shared engine is closed when a client created with config method is closed
• KTOR-9485 Apache5: FutureCallback never called, breaking Java agent instrumentation
• KTOR-9497 Darwin: SIGABRT crash when close() races with in-flight execute() since 3.4.2
• KTOR-9431 SuspendFunctionGun: ThreadContextElement leaks across requests when interceptor suspends
• KTOR-9423 CannotTransformContentToTypeException leaks internal class names in response body
• KTOR-9461 Incorrect link to the OWASP cheatsheet in the KDoc for CSRF plugin
• KTOR-9476 Unable to update/remove session data if no response content
• KTOR-9343 HttpRequestLifecycle plugin with cancelCallOnClose on, cancels subsequent requests when CallLogging plugin with callIdMdc is installed

3.4.2

Published 27 March 2026

Improvements

• KTOR-9327 Curl: The WebSockets maxFrameSize option does not have an effect
• KTOR-9383 CaseInsensitiveString: reduce allocations
• KTOR-9385 Netty: Allocation micro-optimizations
• KTOR-9403 Darwin: Unnecessary ByteArray copy for each received response chunk
• KTOR-9412 KDoc for formFieldLimit documents incorrect default value (64 KB instead of 50 MiB)

Bugfixes

• KTOR-9351 OpenAPI: Incorrect schema generated for nested classes with lists
• KTOR-9361 WebSockets: JsWebSocketSession._closeReason is completed twice
• KTOR-9437 Fix GraalVM Compatibility
• KTOR-9424 Logging: OkHttp format should log the full requested URL
• KTOR-8540 Logging: IllegalStateException is thrown when response is cached and deserialization fails
• KTOR-9370 OpenAPI: NoSuchMethodError - getLOCAL_FUNCTION_FOR_LAMBDA with Kotlin 2.3.20-*
• KTOR-9421 Netty: active SSE connection blocks HTTP/2 response flushing for other requests
• KTOR-3390 JS browser: "Failed to execute 'digest' on 'SubtleCrypto'" error when using digest auth
• KTOR-5977 Compression: The encoders buffer streaming response
• KTOR-9393 Certificate pinning matches against all pins instead of hostname-scoped pins
• KTOR-8751 DI: AmbiguousDependencyException when named dependency is overridden in testApplication
• KTOR-9039 Bearer Auth: Request body transformed with jsonIO isn't sent over again after refreshToken request
• KTOR-9404 Darwin: Memory leak in KtorNSURLSessionDelegate
• KTOR-9399 LinkageError when running Ktor app with development mode inside Spring Boot / Amper fat-JAR
• KTOR-9402 NoSuchMethodError on RawWebSocket after 3.4.0
• KTOR-9372 Frame.Text.readText() causes infinite loop and 100% CPU on Kotlin/Native when WebSocket frame data is malformed or connection drops unexpectedly
• KTOR-9387 ZstdEncoder decode fails when source data is split into multiple Zstd frames

3.4.1

Published 3 March 2026

... (truncated)

Commits

• 5d9a998 Release 3.4.3 (#5547)
• 6a11a76 KTOR-8989 Close or cancel engine only when the client reference count… (#5525)
• 3acb8ea KTOR-8938 Inherit server coroutine context in WebSocket session (#5426)
• cec7d38 Fix flaky test failures on native platforms (#5485)
• bd8bea1 KTOR-9507 Update Jackson to 2.21 and 3.1.0
• 5e29515 KTOR-9507 Update netty to 4.2.12
• 733b8e1 KTOR-9373 Make ConcurrentMap iteration safe on Native (#5407)
• 1f83f21 KTOR-9451 Support nested generic types (#5500)
• 2440990 Apache 5 Client. Don't ignore resultCallback (#5526)
• 430f320 Follow-up: KTOR-9497 Preventing a fatal crash in DarwinSession on close (#5533)
• Additional commits viewable in compare view

Updates io.ktor:ktor-client-cio from 3.0.0 to 3.4.3

Release notes

Sourced from io.ktor:ktor-client-cio's releases.

3.4.3

Published 22 April 2026

Bugfixes

• KTOR-9451 OpenAPI schema inference not working for custom nested generics
• KTOR-9490 OpenAPI: Self-referential schema $ref uses FQN while schema is registered with a simple name
• KTOR-9463 OpenAPI: schema inference StackOverflow
• KTOR-8938 WebSockets: WebSockets handler does not inherit server coroutine context
• KTOR-8989 Shared engine is closed when a client created with config method is closed
• KTOR-9485 Apache5: FutureCallback never called, breaking Java agent instrumentation
• KTOR-9497 Darwin: SIGABRT crash when close() races with in-flight execute() since 3.4.2
• KTOR-9431 SuspendFunctionGun: ThreadContextElement leaks across requests when interceptor suspends
• KTOR-9423 CannotTransformContentToTypeException leaks internal class names in response body
• KTOR-9461 Incorrect link to the OWASP cheatsheet in the KDoc for CSRF plugin
• KTOR-9476 Unable to update/remove session data if no response content
• KTOR-9343 HttpRequestLifecycle plugin with cancelCallOnClose on, cancels subsequent requests when CallLogging plugin with callIdMdc is installed

3.4.2

Published 27 March 2026

Improvements

• KTOR-9327 Curl: The WebSockets maxFrameSize option does not have an effect
• KTOR-9383 CaseInsensitiveString: reduce allocations
• KTOR-9385 Netty: Allocation micro-optimizations
• KTOR-9403 Darwin: Unnecessary ByteArray copy for each received response chunk
• KTOR-9412 KDoc for formFieldLimit documents incorrect default value (64 KB instead of 50 MiB)

Bugfixes

• KTOR-9351 OpenAPI: Incorrect schema generated for nested classes with lists
• KTOR-9361 WebSockets: JsWebSocketSession._closeReason is completed twice
• KTOR-9437 Fix GraalVM Compatibility
• KTOR-9424 Logging: OkHttp format should log the full requested URL
• KTOR-8540 Logging: IllegalStateException is thrown when response is cached and deserialization fails
• KTOR-9370 OpenAPI: NoSuchMethodError - getLOCAL_FUNCTION_FOR_LAMBDA with Kotlin 2.3.20-*
• KTOR-9421 Netty: active SSE connection blocks HTTP/2 response flushing for other requests
• KTOR-3390 JS browser: "Failed to execute 'digest' on 'SubtleCrypto'" error when using digest auth
• KTOR-5977 Compression: The encoders buffer streaming response
• KTOR-9393 Certificate pinning matches against all pins instead of hostname-scoped pins
• KTOR-8751 DI: AmbiguousDependencyException when named dependency is overridden in testApplication
• KTOR-9039 Bearer Auth: Request body transformed with jsonIO isn't sent over again after refreshToken request
• KTOR-9404 Darwin: Memory leak in KtorNSURLSessionDelegate
• KTOR-9399 LinkageError when running Ktor app with development mode inside Spring Boot / Amper fat-JAR
• KTOR-9402 NoSuchMethodError on RawWebSocket after 3.4.0
• KTOR-9372 Frame.Text.readText() causes infinite loop and 100% CPU on Kotlin/Native when WebSocket frame data is malformed or connection drops unexpectedly
• KTOR-9387 ZstdEncoder decode fails when source data is split into multiple Zstd frames

3.4.1

Published 3 March 2026

Improvements

... (truncated)

Changelog

Sourced from io.ktor:ktor-client-cio's changelog.

3.4.3

Published 22 April 2026

Bugfixes

• KTOR-9451 OpenAPI schema inference not working for custom nested generics
• KTOR-9490 OpenAPI: Self-referential schema $ref uses FQN while schema is registered with a simple name
• KTOR-9463 OpenAPI: schema inference StackOverflow
• KTOR-8938 WebSockets: WebSockets handler does not inherit server coroutine context
• KTOR-8989 Shared engine is closed when a client created with config method is closed
• KTOR-9485 Apache5: FutureCallback never called, breaking Java agent instrumentation
• KTOR-9497 Darwin: SIGABRT crash when close() races with in-flight execute() since 3.4.2
• KTOR-9431 SuspendFunctionGun: ThreadContextElement leaks across requests when interceptor suspends
• KTOR-9423 CannotTransformContentToTypeException leaks internal class names in response body
• KTOR-9461 Incorrect link to the OWASP cheatsheet in the KDoc for CSRF plugin
• KTOR-9476 Unable to update/remove session data if no response content
• KTOR-9343 HttpRequestLifecycle plugin with cancelCallOnClose on, cancels subsequent requests when CallLogging plugin with callIdMdc is installed

3.4.2

Published 27 March 2026

Improvements

• KTOR-9327 Curl: The WebSockets maxFrameSize option does not have an effect
• KTOR-9383 CaseInsensitiveString: reduce allocations
• KTOR-9385 Netty: Allocation micro-optimizations
• KTOR-9403 Darwin: Unnecessary ByteArray copy for each received response chunk
• KTOR-9412 KDoc for formFieldLimit documents incorrect default value (64 KB instead of 50 MiB)

Bugfixes

• KTOR-9351 OpenAPI: Incorrect schema generated for nested classes with lists
• KTOR-9361 WebSockets: JsWebSocketSession._closeReason is completed twice
• KTOR-9437 Fix GraalVM Compatibility
• KTOR-9424 Logging: OkHttp format should log the full requested URL
• KTOR-8540 Logging: IllegalStateException is thrown when response is cached and deserialization fails
• KTOR-9370 OpenAPI: NoSuchMethodError - getLOCAL_FUNCTION_FOR_LAMBDA with Kotlin 2.3.20-*
• KTOR-9421 Netty: active SSE connection blocks HTTP/2 response flushing for other requests
• KTOR-3390 JS browser: "Failed to execute 'digest' on 'SubtleCrypto'" error when using digest auth
• KTOR-5977 Compression: The encoders buffer streaming response
• KTOR-9393 Certificate pinning matches against all pins instead of hostname-scoped pins
• KTOR-8751 DI: AmbiguousDependencyException when named dependency is overridden in testApplication
• KTOR-9039 Bearer Auth: Request body transformed with jsonIO isn't sent over again after refreshToken request
• KTOR-9404 Darwin: Memory leak in KtorNSURLSessionDelegate
• KTOR-9399 LinkageError when running Ktor app with development mode inside Spring Boot / Amper fat-JAR
• KTOR-9402 NoSuchMethodError on RawWebSocket after 3.4.0
• KTOR-9372 Frame.Text.readText() causes infinite loop and 100% CPU on Kotlin/Native when WebSocket frame data is malformed or connection drops unexpectedly
• KTOR-9387 ZstdEncoder decode fails when source data is split into multiple Zstd frames

3.4.1

Published 3 March 2026

... (truncated)

Commits

• 5d9a998 Release 3.4.3 (#5547)
• 6a11a76 KTOR-8989 Close or cancel engine only when the client reference count… (#5525)
• 3acb8ea KTOR-8938 Inherit server coroutine context in WebSocket session (#5426)
• cec7d38 Fix flaky test failures on native platforms (#5485)
• bd8bea1 KTOR-9507 Update Jackson to 2.21 and 3.1.0
• 5e29515 KTOR-9507 Update netty to 4.2.12
• 733b8e1 KTOR-9373 Make ConcurrentMap iteration safe on Native (#5407)
• 1f83f21 KTOR-9451 Support nested generic types (#5500)
• 2440990 Apache 5 Client. Don't ignore resultCallback (#5526)
• 430f320 Follow-up: KTOR-9497 Preventing a fatal crash in DarwinSession on close (#5533)
• Additional commits viewable in compare view

Updates io.ktor:ktor-client-java from 3.0.0 to 3.4.3

Release notes

Sourced from io.ktor:ktor-client-java's releases.

3.4.3

Published 22 April 2026

Bugfixes

• KTOR-9451 OpenAPI schema inference not working for custom nested generics
• KTOR-9490 OpenAPI: Self-referential schema $ref uses FQN while schema is registered with a simple name
• KTOR-9463 OpenAPI: schema inference StackOverflow
• KTOR-8938 WebSockets: WebSockets handler does not inherit server coroutine context
• KTOR-8989 Shared engine is closed when a client created with config method is closed
• KTOR-9485 Apache5: FutureCallback never called, breaking Java agent instrumentation
• KTOR-9497 Darwin: SIGABRT crash when close() races with in-flight execute() since 3.4.2
• KTOR-9431 SuspendFunctionGun: ThreadContextElement leaks across requests when interceptor suspends
• KTOR-9423 CannotTransformContentToTypeException leaks internal class names in response body
• KTOR-9461 Incorrect link to the OWASP cheatsheet in the KDoc for CSRF plugin
• KTOR-9476 Unable to update/remove session data if no response content
• KTOR-9343 HttpRequestLifecycle plugin with cancelCallOnClose on, cancels subsequent requests when CallLogging plugin with callIdMdc is installed

3.4.2

Published 27 March 2026

Improvements

• KTOR-9327 Curl: The WebSockets maxFrameSize option does not have an effect
• KTOR-9383 CaseInsensitiveString: reduce allocations
• KTOR-9385 Netty: Allocation micro-optimizations
• KTOR-9403 Darwin: Unnecessary ByteArray copy for each received response chunk
• KTOR-9412 KDoc for formFieldLimit documents incorrect default value (64 KB instead of 50 MiB)

Bugfixes

• KTOR-9351 OpenAPI: Incorrect schema generated for nested classes with lists
• KTOR-9361 WebSockets: JsWebSocketSession._closeReason is completed twice
• KTOR-9437 Fix GraalVM Compatibility
• KTOR-9424 Logging: OkHttp format should log the full requested URL
• KTOR-8540 Logging: IllegalStateException is thrown when response is cached and deserialization fails
• KTOR-9370 OpenAPI: NoSuchMethodError - getLOCAL_FUNCTION_FOR_LAMBDA with Kotlin 2.3.20-*
• KTOR-9421 Netty: active SSE connection blocks HTTP/2 response flushing for other requests
• KTOR-3390 JS browser: "Failed to execute 'digest' on 'SubtleCrypto'" error when using digest auth
• KTOR-5977 Compression: The encoders buffer streaming response
• KTOR-9393 Certificate pinning matches against all pins instead of hostname-scoped pins
• KTOR-8751 DI: AmbiguousDependencyException when named dependency is overridden in testApplication
• KTOR-9039 Bearer Auth: Request body transformed with jsonIO isn't sent over again after refreshToken request
• KTOR-9404 Darwin: Memory leak in KtorNSURLSessionDelegate
• KTOR-9399 LinkageError when running Ktor app with development mode inside Spring Boot / Amper fat-JAR
• KTOR-9402 NoSuchMethodError on RawWebSocket after 3.4.0
• KTOR-9372 Frame.Text.readText() causes infinite loop and 100% CPU on Kotlin/Native when WebSocket frame data is malformed or connection drops unexpectedly