build: Kotlin 2.4.20; actualize the Kotlin/JS yarn.lock; drop the webpack pin - #1304
Merged
Merged
Conversation
…pack pin Bumps Kotlin from 2.4.10 to 2.4.20 in all three places it is pinned, as one change: the version catalog (#1272) and the build-logic kotlin("jvm") (#1271) and kotlin("plugin.serialization") (#1273) plugins. Dependabot split them into three PRs that cannot pass on their own. #1272 failed only at :kotlinStoreYarnLock ("Lock file was changed"), the same failure as the Kotlin 2.4.0 bump (3101aa4): the new Kotlin Gradle plugin brings a newer JS toolchain, and Dependabot does not regenerate kotlin-js-store/yarn.lock. Regenerated with kotlinUpgradeYarnLock / kotlinWasmUpgradeYarnLock. The Wasm lock is unchanged. KGP 2.4.20 requests webpack 5.108.1, past 5.104.1, the first release clearing GHSA-8fgc-7cc6-rx7x and GHSA-38r7-794h-5758. The npm-webpack resolution was holding the bundler at 5.104.1, behind the version KGP is tested with, so it is dropped as the catalog note asked on the next Kotlin upgrade. The lock now resolves webpack 5.108.1. Every other npm pin still resolves at its pinned version (ws 8.21.1, js-yaml 4.3.2, socket.io-parser 4.2.7, fast-uri 3.1.6, serialize-javascript 7.0.5, qs 6.16.0, brace-expansion 2.1.4, diff 8.0.3). The catalog's usage example that named the webpack pin now uses diff. Tests: the CI js-wasm leg locally (verifyNpmPins jsTest wasmJsTest wasmWasiTest) plus kotlinStoreYarnLock, kotlinWasmStoreYarnLock and apiCheck, green on Kotlin 2.4.20.
aharakal
approved these changes
Sep 24, 2026
This was referenced Sep 24, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supersedes #1271, #1272 and #1273. Those are the three halves of one Kotlin bump, and none can pass alone.
What
kotlin("jvm")andkotlin("plugin.serialization")plugins.kotlin-js-store/yarn.lockregenerated. It was the only failure on chore(deps): Bump kotlin from 2.4.10 to 2.4.20 #1272::kotlinStoreYarnLock, "Lock file was changed". That is the same failure as the Kotlin 2.4.0 bump in 3101aa4. The Wasm lock is unchanged.npm-webpackpin is dropped. KGP 2.4.20 requests webpack 5.108.1, which is already past 5.104.1, the first release that clears GHSA-8fgc-7cc6-rx7x and GHSA-38r7-794h-5758. The pin was now holding webpack behind KGP's tested version, so it is removed as the catalog note asked. Every other npm pin still resolves at its pinned version.Verification
Run locally on Kotlin 2.4.20, all green:
verifyNpmPins jsTest wasmJsTest wasmWasiTest(the CI js-wasm leg),kotlinStoreYarnLock,kotlinWasmStoreYarnLockandapiCheck. CI runs the full matrix here.