Update all dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
io.ktor:ktor-version-catalog	3.5.1 → 3.6.0
de.infix.testBalloon	1.0.1-K2.4.0 → 1.1.0
de.infix.testBalloon:testBalloon-framework-core	1.0.1-K2.4.0 → 1.1.0
com.sksamuel.cohort:cohort-ktor	2.9.10 → 2.9.11
com.sksamuel.cohort:cohort-hikari	2.9.10 → 2.9.11

---

Release Notes

ktorio/ktor (io.ktor:ktor-version-catalog)

v3.6.0

Compare Source

Published 16 September 2026

Features

• KTOR-8596 OpenID Connect (OAuth2) auto-discover & configuration
• KTOR-9645 Client curated multi-platform facade module
• KTOR-8883 Support nested jars in static resources
• KTOR-8672 Support at least zstd and deflate formats of precompressed files
• KTOR-8595 Auth JWK Support (auto-discover)
• KTOR-9841 OIDC Server Plugin
• KTOR-9654 Override fetch in JS engine
• KTOR-9785 Typesafe Authentication DSL
• KTOR-462 Async CIO DNS resolver with timeout
• KTOR-9709 Add resource attribute for client resources plugin
• KTOR-5009 ContentNegotiation: Add a way to prevent changing Accept and Content-Type headers
• KTOR-9776 OpenAPI: Support the "const" validation keyword
• KTOR-7468 DefaultConversionService: Support Uuid type introduced in Kotlin 2.0
• KTOR-9578 HttpCache add method for clearing
• KTOR-9590 OpenAPI Contextual JSON schema inference support
• KTOR-6610 Log which ConfigLoader has been used for loading the server configuration
• KTOR-9735 Commonize HttpCache FileCacheStorage
• KTOR-8953 WebRTC client on JVM
• KTOR-9674 UDP support for Node.js targets
• KTOR-9612 Add text/markdown to the ContentType constants

Improvements

• KTOR-9876 Typo in KDoc for routing function: "for the this Application".
• KTOR-9778 Character classification in ktor-http hot paths uses boxed Set lookups and per-symbol encoder allocations
• KTOR-9702 Duplicate code in ByteReadChannel
• KTOR-9716 Make ApplicationCallPipeline.ApplicationPhase.Validators public in 3.6.0
• KTOR-9734 Use TagConsumer in respondHtmlFragment lambda receiver
• KTOR-5577 Support nullable types in ApplicationCall.receive
• KTOR-2367 OAuth: clients expect to get authenticated once per "session" for all protected routes
• KTOR-8594 Auth: Non-optional principal is of nullable type
• KTOR-9816 Escape $ in application.yaml file
• KTOR-8193 Unnecessary blocking in OutputStream wrapper

Bugfixes

• KTOR-8705 testApplication: call coroutine context isn't preserved when responding with ChannelWriterContent
• KTOR-9248 JWTAuthenticationProvider silently swallows exceptions
• KTOR-9892 Digest Auth client: nc and qop are not handled according to RFC 7616
• KTOR-9891 CIO on Kotlin/Native collapses above ~50 connections: HttpHeadersMap pools contend on an allocating SynchronizedObject
• KTOR-9794 Digest Auth: NullPointerException when the server does not expect Digest auth
• KTOR-9788 Netty: engine double-responds after its built-in 400, crashing the call-handler coroutine with "Headers can no longer be set because response was already completed"
• KTOR-9834 HttpClient eagerly initializes SLF4J during Android startup
• KTOR-9701 Jackson/Gson converters waste time on unnecessary Dispatchers.IO dispatch
• KTOR-9832 Apache5: Upgrading Apache HttpClient5 to version 5.6 breaks the Ktor client with Content-Length mismatch error for any gzipped content
• KTOR-9870 OkHttp: Reduce coroutine dispatching and allocations while reading response bodies
• KTOR-9627 Cancel blocking bridges when coroutine is cancelled
• KTOR-7067 Ktor Cookie.parseClientCookiesHeader returns Map, which breaks Cookie header contract
• KTOR-9643 Allow H2C and HTTP/2 on same server
• KTOR-9302 OpenAPI: No way to set tag description
• KTOR-9827 Authorization header removed from refresh token request
• KTOR-8355 Bad percentage encoding in URL query causes uncaught exception and 500 status
• KTOR-9762 Android: can hang when cancelling a streaming response during a blocking read
• KTOR-9443 OpenAPI: "No mapping for symbol: VALUE_PARAMETER" exception when respondText receives a conditional ContentType within ApplicationCall extension function
• KTOR-9392 OpenAPI: "No mapping for symbol: VAR name" exception when code inference is on
• KTOR-9389 OpenAPI: "IllegalStateException: No mapping for symbol" when code inference and passing received body to HttpStatusCode()
• KTOR-9784 Multipart is not supported on non-JVM server targets
• KTOR-9657 OpenAPI: generated schema for recursive types uses invalid schemaRef with ReflectionJsonSchemaInference
• KTOR-9676 Incorrect warning about streaming compression buffering
• KTOR-9712 Netty HTTP/3: the listener can only ever serve ONE QUIC connection — every subsequent handshake times out
• KTOR-9386 Misleading log output for Unix Domain Socket servers: "Responding at unix://0.0.0.0:80"
• KTOR-8755 CIO: The engine doesn't encode Unicode symbols like '–' (U+2013) in request URL
• KTOR-9513 CharsetDecoder.decode() ignores the max argument on JVM
• KTOR-9825 Unescape quoted-pair at the end of a header parameter value
• KTOR-9731 CIO: HttpRequestLifecycle cancels Connection: close call too soon, sending an incomplete response
• KTOR-9770 CIO: mapToKtor unwraps non-timeout exceptions to their cause
• KTOR-9772 Make quality parameter case-insensitive
• KTOR-9773 OkHttp: Cancelling a request can close the response body on the Android main thread
• KTOR-7009 CIO: "Failed to parse HTTP response: unexpected EOF" when pipelining is on
• KTOR-9819 Curl: Requests leak curl_slist and response StableRef
• KTOR-9761 CIO server: request handler can leak when idle timeout cancels a claimed response
• KTOR-9817 Darwin CertificatePinner over-releases borrowed Core Foundation references
• KTOR-9774 CIO: pipelining corrupts requests with non-empty bodies
• KTOR-9766 OpenAPI: "has no continuation" AssertionError when a suspend call inside a sealed-type branch reads the smart-cast value
• KTOR-9775 OkHttp: duplex streaming does not release the connection after the request completes
• KTOR-9722 DigestAuthProvider cannot be initialized with a congested Dispatchers.Default pool
• KTOR-9739 Outdated KDoc for AuthProvider.refreshToken method
• KTOR-9792 Application lifecycle events affect other reload generations
• KTOR-9793 The new DI scope is cancelled during hot reload
• KTOR-9648 OpenAPI: reflection schema inference produces incorrect discriminator mapping for Jackson-annotated and nested sealed hierarchies
• KTOR-9760 Digest Auth: URI and HA2 are empty for a URL without a path
• KTOR-9705 OpenAPI UI (ktor-server-openapi) does not support OpenAPI spec 3.1.*
• KTOR-9715 Netty HTTP/3: user handler code is dispatched on the QUIC event loop — one blocking handler freezes the entire HTTP/3 listener (callEventGroup / pinnedCallExecutor not used)
• KTOR-2912 CORS Plugin: Access-Control-Allow-Methods header does not include default methods (GET, POST, HEAD)
• KTOR-9526 Static Content: excluded extension prevents fallback, and index file bypasses exclusion rules
• KTOR-9523 OAuth2: fallback handler not invoked when token endpoint returns invalid_grant
• KTOR-9501 Websockets: Closing WebSocketSession with a long message leads to ProtocolViolationException
• KTOR-9561 ByteReadChannel.copyTo does not propagate source closedCause on normal exit
• KTOR-9640 ktor-io reader/writer ignores autoFlush
• KTOR-9889 DI: Concurrent module loading can cause a deadlock
• KTOR-9886 Netty: inverted skippedRead CAS leaves runningLimit read-resumption broken; runningLimit = 1 deadlocks keep-alive connections

v3.5.2

Compare Source

Published 31 July 2026

Improvements

• KTOR-8032 RateLimit: Allow limit requests based on authentication result
• KTOR-9719 ApplicationCall.isStaticContent returns false when called from plugin interceptors
• KTOR-8450 ContentNegotiation: it doesn't handle content type suffixes
• KTOR-7892 SwaggerUI: Missing oauth2-redirect.html support in the plugin
• KTOR-9759 Reject whitespace in URL hosts during parsing
• KTOR-9681 Update kotlinx-io to 0.9.1
• KTOR-9743 ByteReadChannel.readLineStrict: Misleading definition of limit parameter in KDocs
• KTOR-9504 Improve KDoc for EmbeddedServer.addShutdownHook

Bugfixes

• KTOR-9741 CIO: request-handler coroutine leak on half-closed idle connection after ≥1MB response
• KTOR-7661 Maven + YAML config file does not work
• KTOR-9585 OpenAPI: JsonSchema title is truncated when it contains a dot
• KTOR-9704 UTF-8 encoding in ktor-io bypasses JVM String.getBytes intrinsics, slowing every text response by 5-7x
• KTOR-9588 SSE client (CIO engine) sends spurious Content-Length: 0 on body-less GET (RFC 9110 § 8.6 violation; rejected by AWS ELB)
• KTOR-9679 ByteReadChannel.readLine corrupts multi-byte UTF-8 by splitting a character at a buffer boundary
• KTOR-9767 ByteReadChannel.readLineTo: Return read bytes count instead of decoded characters count
• KTOR-8992 HoconConfigLoader is not loaded when ktor-server-config-yaml on the classpath
• KTOR-9698 OpenAPI: schema for kotlinx.serialization sealed types omits discriminator property in variant schemas
• KTOR-9690 Netty: in-flight requests are aborted on stop(), ignoring shutdown grace period
• KTOR-8903 Netty: Close channel connection on errors properly
• KTOR-9707 SaveBody performance regression
• KTOR-9703 Inefficient text reading function in DefaultTransform
• KTOR-9711 Netty HTTP/2: a single client-canceled stream (RST_STREAM) breaks response flushing for the whole connection
• KTOR-9688 RateLimit: No access to principal when wrapped with authentication since 3.5.1
• KTOR-9677 Auto-reloading: server is reloaded only once since 3.5.0
• KTOR-9683 Sockets: Canceling a SelectorManager job doesn't close it properly
• KTOR-9671 Darwin: Semicolons in URL path are sanitized

infix-de/testBalloon (de.infix.testBalloon)

v1.1.0

Compare Source

This is a unified release with a single artifact set for Kotlin versions 2.2.0 and higher. TestBalloon's Gradle and compiler plugins auto-adapt to the Kotlin compiler version in use.

For this release, there is only one version: 1.1.0. The old versioning scheme (using "1.0.1-K2.4.0" and the like) is history.

Compatibility

• This release has been tested with Kotlin versions 2.2.0 … 2.5.0-dev-1759. It is binary compatible with 1.0.1.
• For Kotlin versions 2.0.0 … 2.1.x, please use the corresponding TestBalloon 1.0.1 release variants.

Changed Behavior

• Test selection patterns no longer accept a pipe | character to separate path elements, as this prevented selecting an element with a pipe character inside its path. To use the pipe character as a separator, make it a custom separator:
  • Instead of --tests "com.example.TestSuite|inner suite|*"
  • use --tests "|com.example.TestSuite|inner suite|*".

Fixes

• Gradle plugin: Android-only unit tests no longer fail with "MissingFrameworkSymbol: Could not find class JvmEntryPoint" (#​84)
• Robolectric integration: Compose UI tests no longer fail with "UnsupportedOperationException: main looper can only be controlled from main thread." (#​82)

Other Changes

• JUnit Platform: report IncompleteExecutionException as aborted by @​tKe in #​94

sksamuel/cohort (com.sksamuel.cohort:cohort-ktor)

v2.9.11

What's Changed

• Update hikari to v7.1.0 by @​renovate[bot] in #​295
• Handle null ClusterHealthStatus distinctly in ElasticClusterHealthCheck by @​sksamuel in #​242
• Update jedis to v7.5.2 by @​renovate[bot] in #​287
• Update jackson monorepo to v2.22.0 by @​renovate[bot] in #​285
• Update mockk to v1.14.11 by @​renovate[bot] in #​286
• Update flyway to v12.9.0 by @​renovate[bot] in #​288
• Add cohort-clickhouse module with a connectivity health check by @​sksamuel in #​301
• Update dependency com.rabbitmq:amqp-client to v5.32.0 by @​renovate[bot] in #​297
• Update dependency redis.clients:jedis to v7.5.3 by @​renovate[bot] in #​312
• Update dependency org.flywaydb:flyway-core to v12.11.0 by @​renovate[bot] in #​311
• Update Gradle to v9.7.1 by @​renovate[bot] in #​309
• Update vertx to v5.1.8 by @​renovate[bot] in #​303
• Update logback monorepo to v1.6.3 by @​renovate[bot] in #​304
• Update dependency com.rabbitmq:amqp-client to v5.36.0 by @​renovate[bot] in #​310
• Update ktor monorepo to v3.5.2 by @​renovate[bot] in #​308
• Update dependency io.micrometer:micrometer-core to v1.17.1 by @​renovate[bot] in #​313
• Update dependency co.elastic.clients:elasticsearch-java to v8.19.21 - autoclosed by @​renovate[bot] in #​305
• Update dependency org.apache.kafka:kafka-clients to v4.3.1 by @​renovate[bot] in #​306
• Update dependency java-jdk to v17.0.20+101 by @​renovate[bot] in #​314
• Make /threaddump output readable: StringBuilder + line separator by @​sksamuel in #​221
• Report unhealthy when KafkaConsumerLastPoll metric is missing by @​sksamuel in #​212
• Treat unavailable CPU/load metrics as unhealthy by @​sksamuel in #​202
• Take HttpClient externally in Vertx Endpoint(Startup)HealthCheck (BREAKING) by @​sksamuel in #​236
• Convert createClient/shutdown failures to Unhealthy in DynamoDB check by @​sksamuel in #​234

Full Changelog: sksamuel/cohort@v2.9.10...v2.9.11

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.