Skip to content

Bump the all group with 17 updates - #385

Merged
IRus merged 1 commit into
mainfrom
dependabot/gradle/all-18e7cebc9e
Sep 20, 2026
Merged

Bump the all group with 17 updates#385
IRus merged 1 commit into
mainfrom
dependabot/gradle/all-18e7cebc9e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 20, 2026

Copy link
Copy Markdown
Contributor

Bumps the all group with 17 updates:

Package From To
org.http4k:http4k-server-netty 6.59.0.0 6.60.0.0
org.bouncycastle:bcpkix-jdk18on 1.85 1.86
io.heapy.kotaml:kotaml 0.110.0 0.111.0
io.ktor:ktor-client-cio 3.5.2 3.6.0
io.ktor:ktor-client-content-negotiation 3.5.2 3.6.0
io.ktor:ktor-serialization-kotlinx-json 3.5.2 3.6.0
io.ktor:ktor-server-auth-jwt 3.5.2 3.6.0
io.ktor:ktor-server-caching-headers 3.5.2 3.6.0
io.ktor:ktor-server-call-logging 3.5.2 3.6.0
io.ktor:ktor-server-cio 3.5.2 3.6.0
io.ktor:ktor-server-content-negotiation 3.5.2 3.6.0
io.ktor:ktor-server-default-headers 3.5.2 3.6.0
io.ktor:ktor-server-metrics-micrometer 3.5.2 3.6.0
io.ktor:ktor-server-resources 3.5.2 3.6.0
io.ktor:ktor-server-status-pages 3.5.2 3.6.0
io.ktor:ktor-server-test-host 3.5.2 3.6.0
io.ktor:ktor-server-websockets 3.5.2 3.6.0

Updates org.http4k:http4k-server-netty from 6.59.0.0 to 6.60.0.0

Release notes

Sourced from org.http4k:http4k-server-netty's releases.

6.60.0.0

Distribution notice - from 1 October 2026, Maven Central receives http4k releases approximately quarterly. maven.http4k.org continues on the normal 1-2 week cadence. Both channels are supported. Background and current status: DISTRIBUTION.md

Changelog:

  • http4k-*: Upgrade versions
  • http4k-security-digest: [Break] Proper support for Digest auth-int QoP. DigestEncoder.invoke gains a required entityBody parameter and DigestAuthProvider.verify now takes the Request. Note that auth-int requires buffering the request body in memory to hash it.
Changelog

Sourced from org.http4k:http4k-server-netty's changelog.

v6.60.0.0

  • http4k-*: Upgrade versions
  • http4k-security-digest: [Break] Proper support for Digest auth-int QoP. DigestEncoder.invoke gains a required entityBody parameter and DigestAuthProvider.verify now takes the Request. Note that auth-int requires buffering the request body in memory to hash it.
Commits

Updates org.bouncycastle:bcpkix-jdk18on from 1.85 to 1.86

Changelog

Sourced from org.bouncycastle:bcpkix-jdk18on's changelog.

Bouncy Castle Crypto Package - Release Notes

1.0 Introduction

The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. The package is organised so that it contains a light-weight API suitable for use in any environment (including the J2ME) with the additional infrastructure to conform the algorithms to the JCE framework.

2.0 Release History

2.1.1 Version

Release: 1.87
Date: 2026, TBD

2.1.2 Defects Fixed

  • A KeyAgreement asked for its shared secret before doPhase returned data rather than refusing. javax.crypto.KeyAgreement specifies IllegalStateException for that state, but nothing in the provider tracked it, so each SPI handed back whatever its result field held: for Diffie-Hellman that was the private value itself - engineInit seeded result with x, so generateSecret() returned the private exponent padded to the prime's length and generateSecret("AES") an all-zero key taken from that padding - while ECDH returned null and its named-algorithm overload raised NullPointerException. BaseAgreementSpi now records whether a doPhase has completed the agreement since the last init and refuses the request with an IllegalStateException naming the algorithm, so every family in the provider - DH, ECDH and ECMQV, the SM2 exchange, both ECGOST families, XDH, SM9 and NewHope - answers the same way, and the DH SPI no longer holds the private value in that field at all.

  • Mac.getInstance and KeyGenerator.getInstance by the HMAC SHA-512/224 and SHA-512/256 object identifiers (1.2.840.113549.2.12 and .13) failed, although the same algorithms resolved by name and the matching SecretKeyFactory aliases were registered: the SHA512 mappings called addHMACAlgorithm for the two truncated variants without the addHMACAlias that registers their OIDs against Mac and KeyGenerator. Both are now aliased, as every other HMAC in that class already was.

  • A KTSParameterSpec naming an HKDF key-derivation function with a parameters field - a form the provider does not service - was accepted at Cipher init and then failed out of wrap or unwrap with an unchecked IllegalStateException neither method declares. The KTS key-wrapping Ciphers (ML-KEM, Classic McEliece, FrodoKEM, the composite KEM and RSA-KEM) now validate the spec's KDF when they take it, reporting an unserviceable one as the InvalidAlgorithmParameterException engineInit declares, which is what the javax.crypto.KEM services already did through KdfUtil.resolveKemSpec.

  • A DTLS handshake deadlocked when a handshake message ahead of the peer's ChangeCipherSpec (a client's CertificateVerify, say) was lost while the ChangeCipherSpec and Finished behind it arrived: the record layer moved its read epoch on at the ChangeCipherSpec and then discarded every retransmission of the lost message as belonging to the old epoch, whose records are only accepted once the handshake has completed. Each side then waited on the other until a handshake timeout, if one was configured, ended it. Every client-authenticated handshake, and every handshake in which the server issues a NewSessionTicket, was exposed. Until the handshake completes, handshake records from the current epoch are now still accepted after the read epoch has moved on, and each message is checked against the epoch of the record that carried it. The DTLS loopback tests now run their handshakes at 10% datagram loss in each direction, with a client-authenticated handshake at 25%.

  • The lightweight SubjectPublicKeyInfoFactory and PrivateKeyInfoFactory encoded a GOST R 34.10-2012 key on one of the legacy CryptoPro curves under id-GostR3410-2001, although RFC 9215 sec. 4.2 permits those curves for 2012 keys. The digestParamSet now decides: a GOST R 34.11-94 parameter set means 2001 (RFC 4491 sec. 2.3.2), a GOST R 34.11-2012 digest or none means 2012 with 256/512 taken from the curve field size, and any other value is rejected. GOST3410PublicKeyAlgParameters treats digestParamSet as OPTIONAL on both read and write per RFC 9215, and PrivateKeyInfoFactory now passes attributes through for ECGOST3410 keys (bc-csharp github #707).

  • The name-constraint host canonicalisation removed a single RFC 1034 root-label dot, the only empty label a name may legally carry, but nothing refused the ones that are not legal: a dNSName, rfc822Name host or uniformResourceIdentifier host such as "example.com.." kept a phantom empty label after the strip and so matched no constraint at all, escaping an excluded subtree naming the host it appears to carry. A tested name whose host carries an empty label - a second trailing dot, a doubled dot or a leading dot - is now refused outright wherever a constraint of that type is in force, rather than canonicalised into a name it is not: removing the extra dots would decide on the caller's behalf that "example.com.." names example.com, which is not how a consumer resolving or comparing the name reads it, and refusing fails closed in both directions where canonicalising would newly admit such a name under a permitted subtree. The single trailing dot is canonicalised as before, a bare "." remains the root label rather than an empty one, and the guard is scoped to the host, so the doubled dot a quoted local part may legally carry is unaffected. Constraints are untouched - one may still begin with a dot, which is how this implementation spells "subdomains only" (github PR #2436).

2.1.3 Additional Features and Functionality

2.1.4 Additional Notes

  • The sources and javadoc jars of the Ant-built distributions (jdk14, jdk15to18 and jdk13) no longer carry test material. Each module's javadoc target copies the package documentation it needs - org/bouncycastle///*.html - back into the module source directory that has already been compiled from, and zip-src zips that directory afterwards, so every test package's package.html arrived in the sources jar by that route; javadoc-util additionally copied org/bouncycastle/asn1/isismtt//*.java, which put test classes into the bcutil javadoc as generated pages, and javadoc-pg deliberately copied the gpg and bcpg test sources in order to document them. Separately the source copies excluded test material only one directory deep and only for *.java, because Ant reads ** as an any-depth wildcard just where it is a whole path segment, so anything nested further or with another extension - the PEM certificate fixtures under org/bouncycastle/est/test/san corrected in 1.86, and an ICAO master list under org/bouncycastle/asn1/icao/test - went through. The source and javadoc copies of every module now exclude test directories at any depth, and javadoc-pg no longer documents the test packages. org.bouncycastle.util.test is unaffected and still ships in the bcprov binary, sources and javadoc jars, as it does from the Gradle build: it is the SimpleTest framework the light-weight API's own test classes are written against, not test material of the distribution. No binary changes - the classes and resources of every Ant-built jar are identical to those of the 1.86 release - and the Gradle-built jdk18on artifacts never carried any of this.

2.2.1 Version

Release: 1.86
Date: 2026, 11th September.

2.2.2 Defects Fixed

  • The high-level OpenPGP API let a subkey inherit the primary key's Key Flags when its own Subkey Binding signature carried none, so a subkey bound with no flags counted as signing-capable for one check while the cross-certification check RFC 9580 sec. 5.2.1.8 requires of a signing subkey saw none and was skipped - letting a third party's public signing subkey be bound to an attacker's primary key and that party's genuine signatures verify under the attacker's identity. Flags are no longer inherited (CVE-2026-71887).
  • The high-level OpenPGP API used a version 6 key carrying no valid Direct Key signature, falling back to the primary user ID binding as it correctly does for version 4. RFC 9580 sec. 5.2.3.10 requires the opposite, and since a v6 certificate carries its expiration and preferences there, stripping that one packet silently dropped them - the certificate went on offering subkeys of a key set to expire. isBoundBy now requires a valid Direct Key self-signature before any v6 component is treated as bound; version 4 is unaffected.
  • The high-level OpenPGP API ignored the OpenPGPPolicy a caller had configured when verifying signatures on an inline message: OpenPGPMessageInputStream took the policy from the implementation's own default rather than from the processor doing the verification, so a hardened policy had no bearing on acceptance and getSignatures() reported isTestedCorrect() true for a signature that policy rejects. Both the one-pass and prefixed-signature paths now read the configured policy.
  • The high-level OpenPGP API went on offering the subkeys of a certificate whose primary key had expired, the binding check evaluating only a subkey's own Subkey Binding signature - so the certificate contradicted itself, reporting the primary unbound while still handing out its subkeys. The primary key's expiration now applies to the whole certificate, as GnuPG and Sequoia treat it, and a subkey no longer inherits the primary's validity period, which RFC 9580 sec. 5.2.3.13 counts from the creation time of the key the carrying signature is made on.
  • OpenPGPDocumentSignature.isValidAt(Date) reported a data signature as valid past the signature's own Signature Expiration Time (RFC 9580 sec. 5.2.3.18): it checked that the signature was correct and the issuing key bound and signing-capable at that date, but never the signature's own expiration, so it disagreed with isEffectiveAt() on the same object and with its own javadoc. isValid() and isValid(policy), which evaluate at creation time, are unchanged.
  • The lightweight LMSSigner and HSSSigner refused a key wrapped in ParametersWithRandom, which is how BcContentSignerBuilder passes one once setSecureRandom() has been called, so BcHssLmsContentSignerBuilder failed with "Incorrect Key Parameters" and the two signers raised ClassCastException. All three now unwrap it, as the ML-DSA and SLH-DSA signers already did; the random is accepted and ignored, LMS deriving its message randomiser deterministically from the seed and one-time index.
  • LMS signature verification did not apply two checks RFC 8554 sec. 5.4.2 requires before a signature is processed: step 2g, refusing a signature whose LMS typecode is not the public key's - without it a signature claiming a height-25 parameter set drove a 25-level computation against a height-5 key - and step 2i, refusing a leaf number outside the tree. Neither was a forgery, but both are attacker-chosen work the specification says to refuse up front. Both are now checked.
  • The LMS and HSS key parameter classes now apply at construction the checks their decoders apply, so a key built directly cannot be one the decoder would refuse: LMSPrivateKeyParameters accepted an identifier of any length where the decoder reads exactly 16 bytes, and left q, maxQ and the seed length unchecked, while HSSPrivateKeyParameters checked neither its level count nor that it had a component key and chaining signature per level. The decoders now report a bad version or seed length as IOException rather than IllegalStateException.
  • In the LMS JCE layer, LMSKeyGenParameterSpec.fromNames knew all twenty LMS parameter-set names but only four of the sixteen LM-OTS ones, so none of the SP 800-208 n24 or SHAKE sets could be named; all sixteen are now present. initialize(int, SecureRandom) now reports InvalidParameterException as the JCA specifies, and BCLMSPrivateKey.getIndex takes the exhaustion check and the index read under one monitor.
  • KeyPairGenerator.initialize(int, SecureRandom) is documented to raise InvalidParameterException when the key size is not one the generator supports, and thirty of them raised a bare IllegalArgumentException instead. Every generator in BCPQC, and the ML-DSA, ML-KEM, SLH-DSA, Classic McEliece, FrodoKEM, NTRU and composite ones in the BC provider, now raise the documented type - which extends IllegalArgumentException, so existing catches still match. The two RSA generators translate the lightweight refusal through a new SecurityExceptions.invalidParameterException factory.

... (truncated)

Commits

Updates io.heapy.kotaml:kotaml from 0.110.0 to 0.111.0

Release notes

Sourced from io.heapy.kotaml:kotaml's releases.

v0.111.0

Significant changes

Scalar handling now follows the YAML 1.2 Core Schema

Reading and writing a scalar both used to defer to Kotlin's standard library, which accepts and produces a number of forms the schema does not. The two sides disagreed with each other, and a document could change meaning by being read and written back. Both now resolve values the way the Core Schema defines.

Fixed: re-serializing a document no longer changes the type of a scalar.

Parsing to a YamlNode and serializing it back is now lossless for these:

Scalar in the document Before After
.inf, -.inf, .nan Infinity, -Infinity, NaN — strings unchanged
"123" (quoted) 123 — an integer unchanged
99999999999999999999 1.0E20 — value lost unchanged
1e400 Infinity — a string unchanged
0xFFFFFFFFFFFFFFFFFF "0xFFFFFFFFFFFFFFFFFF" — a string unchanged
٣ (Arabic-Indic digit) 3 — an integer "٣"
1f, 0x1p3 1.0, 8.0 "1f", "0x1p3"
007, +7, 0x7, 1E+003, True 7, 7, 7, 1000.0, true unchanged

A plain scalar that the Core Schema resolves to a number or a boolean now keeps its own text. Nothing is parsed into Long or Double and printed back, so precision survives, Double.toString no longer varies the output by target, and keys that differ only in spelling stay distinct — 7: a next to 007: b used to collapse into one duplicated key.

Fixed: floating point values are written the same way on every target.

Kotlin/JS rendered an integral double as an integer and dropped the sign of negative zero, so the same value produced a different type on that target:

Value JVM / Native Wasm JS before JS after
1.0 1.0 1.0 1 1.0
-0.0 -0.0 -0.0 0 -0.0
1e20 1.0E20 100000000000000000000.0 1e20 100000000000000000000.0

Byte-for-byte output still differs between the platforms' Double.toString implementations. Every target now writes a value that reads back as the same Double.

Fixed: Null and NULL resolve to null.

The Core Schema resolves null, Null, NULL, ~ and the empty scalar to null. Two of those came back as strings. PlainExceptAmbiguous already quoted them on the

... (truncated)

Commits
  • aca66e2 Release v0.111.0
  • 22cabb8 test: remove unused Kotlin target scaffolding
  • 8ff03b5 feat: enforce strict scalar reading with temporary compatibility
  • 7c516d1 fix: preserve scalar text and quoting when writing YAML
  • f1f7530 feat: add YAML Core Schema scalar classifier
  • da2519a chore: add a binary compatibility baseline
  • ccbbab2 chore: add kotgent project configuration
  • 1c6d432 chore(deps): bump the all group with 5 updates (#32)
  • b25fc97 chore(deps): bump actions/setup-java in the all group (#33)
  • bffafff chore(deps): bump com.diffplug.spotless:spotless-plugin-gradle (#31)
  • Additional commits viewable in compare view

Updates io.ktor:ktor-client-cio from 3.5.2 to 3.6.0

Release notes

Sourced from io.ktor:ktor-client-cio's releases.

3.6.0

Published 16 September 2026

Features

  • KTOR-8596 OpenID Connect (OAuth2) auto-discover & configuration
  • KTOR-9645 Client curated multi-platform facade module
  • KTOR-8883 Support nested jars in static resources
  • KTOR-8672 Support at least zstd and deflate formats of precompressed files
  • KTOR-8595 Auth JWK Support (auto-discover)
  • KTOR-9841 OIDC Server Plugin
  • KTOR-9654 Override fetch in JS engine
  • KTOR-9785 Typesafe Authentication DSL
  • KTOR-462 Async CIO DNS resolver with timeout
  • KTOR-9709 Add resource attribute for client resources plugin
  • KTOR-5009 ContentNegotiation: Add a way to prevent changing Accept and Content-Type headers
  • KTOR-9776 OpenAPI: Support the "const" validation keyword
  • KTOR-7468 DefaultConversionService: Support Uuid type introduced in Kotlin 2.0
  • KTOR-9578 HttpCache add method for clearing
  • KTOR-9590 OpenAPI Contextual JSON schema inference support
  • KTOR-6610 Log which ConfigLoader has been used for loading the server configuration
  • KTOR-9735 Commonize HttpCache FileCacheStorage
  • KTOR-8953 WebRTC client on JVM
  • KTOR-9674 UDP support for Node.js targets
  • KTOR-9612 Add text/markdown to the ContentType constants

Improvements

  • KTOR-9876 Typo in KDoc for routing function: "for the this Application".
  • KTOR-9778 Character classification in ktor-http hot paths uses boxed Set lookups and per-symbol encoder allocations
  • KTOR-9702 Duplicate code in ByteReadChannel
  • KTOR-9716 Make ApplicationCallPipeline.ApplicationPhase.Validators public in 3.6.0
  • KTOR-9734 Use TagConsumer in respondHtmlFragment lambda receiver
  • KTOR-5577 Support nullable types in ApplicationCall.receive
  • KTOR-2367 OAuth: clients expect to get authenticated once per "session" for all protected routes
  • KTOR-8594 Auth: Non-optional principal is of nullable type
  • KTOR-9816 Escape $ in application.yaml file
  • KTOR-8193 Unnecessary blocking in OutputStream wrapper

Bugfixes

  • KTOR-8705 testApplication: call coroutine context isn't preserved when responding with ChannelWriterContent
  • KTOR-9248 JWTAuthenticationProvider silently swallows exceptions
  • KTOR-9892 Digest Auth client: nc and qop are not handled according to RFC 7616
  • KTOR-9891 CIO on Kotlin/Native collapses above ~50 connections: HttpHeadersMap pools contend on an allocating SynchronizedObject
  • KTOR-9794 Digest Auth: NullPointerException when the server does not expect Digest auth
  • KTOR-9788 Netty: engine double-responds after its built-in 400, crashing the call-handler coroutine with "Headers can no longer be set because response was already completed"
  • KTOR-9834 HttpClient eagerly initializes SLF4J during Android startup
  • KTOR-9701 Jackson/Gson converters waste time on unnecessary Dispatchers.IO dispatch
  • KTOR-9832 Apache5: Upgrading Apache HttpClient5 to version 5.6 breaks the Ktor client with Content-Length mismatch error for any gzipped content
  • KTOR-9870 OkHttp: Reduce coroutine dispatching and allocations while reading response bodies
  • KTOR-9627 Cancel blocking bridges when coroutine is cancelled
  • KTOR-7067 Ktor Cookie.parseClientCookiesHeader returns Map, which breaks Cookie header contract

... (truncated)

Changelog

Sourced from io.ktor:ktor-client-cio's changelog.

3.6.0

Published 16 September 2026

Features

  • KTOR-8596 OpenID Connect (OAuth2) auto-discover & configuration
  • KTOR-9645 Client curated multi-platform facade module
  • KTOR-8883 Support nested jars in static resources
  • KTOR-8672 Support at least zstd and deflate formats of precompressed files
  • KTOR-8595 Auth JWK Support (auto-discover)
  • KTOR-9841 OIDC Server Plugin
  • KTOR-9654 Override fetch in JS engine
  • KTOR-9785 Typesafe Authentication DSL
  • KTOR-462 Async CIO DNS resolver with timeout
  • KTOR-9709 Add resource attribute for client resources plugin
  • KTOR-5009 ContentNegotiation: Add a way to prevent changing Accept and Content-Type headers
  • KTOR-9776 OpenAPI: Support the "const" validation keyword
  • KTOR-7468 DefaultConversionService: Support Uuid type introduced in Kotlin 2.0
  • KTOR-9578 HttpCache add method for clearing
  • KTOR-9590 OpenAPI Contextual JSON schema inference support
  • KTOR-6610 Log which ConfigLoader has been used for loading the server configuration
  • KTOR-9735 Commonize HttpCache FileCacheStorage
  • KTOR-8953 WebRTC client on JVM
  • KTOR-9674 UDP support for Node.js targets
  • KTOR-9612 Add text/markdown to the ContentType constants

Improvements

  • KTOR-9876 Typo in KDoc for routing function: "for the this Application".
  • KTOR-9778 Character classification in ktor-http hot paths uses boxed Set lookups and per-symbol encoder allocations
  • KTOR-9702 Duplicate code in ByteReadChannel
  • KTOR-9716 Make ApplicationCallPipeline.ApplicationPhase.Validators public in 3.6.0
  • KTOR-9734 Use TagConsumer in respondHtmlFragment lambda receiver
  • KTOR-5577 Support nullable types in ApplicationCall.receive
  • KTOR-2367 OAuth: clients expect to get authenticated once per "session" for all protected routes
  • KTOR-8594 Auth: Non-optional principal is of nullable type
  • KTOR-9816 Escape $ in application.yaml file
  • KTOR-8193 Unnecessary blocking in OutputStream wrapper

Bugfixes

  • KTOR-8705 testApplication: call coroutine context isn't preserved when responding with ChannelWriterContent
  • KTOR-9248 JWTAuthenticationProvider silently swallows exceptions
  • KTOR-9892 Digest Auth client: nc and qop are not handled according to RFC 7616
  • KTOR-9891 CIO on Kotlin/Native collapses above ~50 connections: HttpHeadersMap pools contend on an allocating SynchronizedObject
  • KTOR-9794 Digest Auth: NullPointerException when the server does not expect Digest auth
  • KTOR-9788 Netty: engine double-responds after its built-in 400, crashing the call-handler coroutine with "Headers can no longer be set because response was already completed"
  • KTOR-9834 HttpClient eagerly initializes SLF4J during Android startup
  • KTOR-9701 Jackson/Gson converters waste time on unnecessary Dispatchers.IO dispatch
  • KTOR-9832 Apache5: Upgrading Apache HttpClient5 to version 5.6 breaks the Ktor client with Content-Length mismatch error for any gzipped content
  • KTOR-9870 OkHttp: Reduce coroutine dispatching and allocations while reading response bodies
  • KTOR-9627 Cancel blocking bridges when coroutine is cancelled
  • KTOR-7067 Ktor Cookie.parseClientCookiesHeader returns Map, which breaks Cookie header contract

... (truncated)

Commits
  • 111c580 Release 3.6.0 (#5882)
  • 1e4186c KTOR-9876 Fix typo in Application.routing KDoc (#5876)
  • 6930eee Fix KTOR-9892 Digest Auth client: nc and qop ... (#5875)
  • 875b2f0 Fix KTOR-9794 Digest Auth: NullPointerException when the server does not expe...
  • dc56137 KTOR-8705 Pass coroutine context to the channel writer (#5868)
  • 55f6e71 Fix KTOR-9640 forward autoFlush in reader/writer helpers
  • 2b04a1f Fix KTOR-9248 JWTAuthenticationProvider silently swallows exceptions (#5877)
  • 702ff9f KTOR-9889 Fix deadlock in concurrent module loading with Dependency Injection...
  • 1fab5f1 Reject Accept entries with q=0 in ContentNegotiation (#5873)
  • b06c3b5 KTOR-9891 Delegate SynchronizedObject to kotlinx.atomicfu on Native (#5874)
  • Additional commits viewable in compare view

Updates io.ktor:ktor-client-content-negotiation from 3.5.2 to 3.6.0

Release notes

Sourced from io.ktor:ktor-client-content-negotiation's releases.

3.6.0

Published 16 September 2026

Features

  • KTOR-8596 OpenID Connect (OAuth2) auto-discover & configuration
  • KTOR-9645 Client curated multi-platform facade module
  • KTOR-8883 Support nested jars in static resources
  • KTOR-8672 Support at least zstd and deflate formats of precompressed files
  • KTOR-8595 Auth JWK Support (auto-discover)
  • KTOR-9841 OIDC Server Plugin
  • KTOR-9654 Override fetch in JS engine
  • KTOR-9785 Typesafe Authentication DSL
  • KTOR-462 Async CIO DNS resolver with timeout
  • KTOR-9709 Add resource attribute for client resources plugin
  • KTOR-5009 ContentNegotiation: Add a way to prevent changing Accept and Content-Type headers
  • KTOR-9776 OpenAPI: Support the "const" validation keyword
  • KTOR-7468 DefaultConversionService: Support Uuid type introduced in Kotlin 2.0
  • KTOR-9578 HttpCache add method for clearing
  • KTOR-9590 OpenAPI Contextual JSON schema inference support
  • KTOR-6610 Log which ConfigLoader has been used for loading the server configuration
  • KTOR-9735 Commonize HttpCache FileCacheStorage
  • KTOR-8953 WebRTC client on JVM
  • KTOR-9674 UDP support for Node.js targets
  • KTOR-9612 Add text/markdown to the ContentType constants

Improvements

  • KTOR-9876 Typo in KDoc for routing function: "for the this Application".
  • KTOR-9778 Character classification in ktor-http hot paths uses boxed Set lookups and per-symbol encoder allocations
  • KTOR-9702 Duplicate code in ByteReadChannel
  • KTOR-9716 Make ApplicationCallPipeline.ApplicationPhase.Validators public in 3.6.0
  • KTOR-9734 Use TagConsumer in respondHtmlFragment lambda receiver
  • KTOR-5577 Support nullable types in ApplicationCall.receive
  • KTOR-2367 OAuth: clients expect to get authenticated once per "session" for all protected routes
  • KTOR-8594 Auth: Non-optional principal is of nullable type
  • KTOR-9816 Escape $ in application.yaml file
  • KTOR-8193 Unnecessary blocking in OutputStream wrapper

Bugfixes

  • KTOR-8705 testApplication: call coroutine context isn't preserved when responding with ChannelWriterContent
  • KTOR-9248 JWTAuthenticationProvider silently swallows exceptions
  • KTOR-9892 Digest Auth client: nc and qop are not handled according to RFC 7616
  • KTOR-9891 CIO on Kotlin/Native collapses above ~50 connections: HttpHeadersMap pools contend on an allocating SynchronizedObject
  • KTOR-9794 Digest Auth: NullPointerException when the server does not expect Digest auth
  • KTOR-9788 Netty: engine double-responds after its built-in 400, crashing the call-handler coroutine with "Headers can no longer be set because response was already completed"
  • KTOR-9834 HttpClient eagerly initializes SLF4J during Android startup
  • KTOR-9701 Jackson/Gson converters waste time on unnecessary Dispatchers.IO dispatch
  • KTOR-9832 Apache5: Upgrading Apache HttpClient5 to version 5.6 breaks the Ktor client with Content-Length mismatch error for any gzipped content
  • KTOR-9870 OkHttp: Reduce coroutine dispatching and allocations while reading response bodies
  • KTOR-9627 Cancel blocking bridges when coroutine is cancelled
  • KTOR-7067 Ktor Cookie.parseClientCookiesHeader returns Map, which breaks Cookie header contract

... (truncated)

Changelog

Sourced from io.ktor:ktor-client-content-negotiation's changelog.

3.6.0

Published 16 September 2026

Features

  • KTOR-8596 OpenID Connect (OAuth2) auto-discover & configuration
  • KTOR-9645 Client curated multi-platform facade module
  • KTOR-8883 Support nested jars in static resources
  • KTOR-8672 Support at least zstd and deflate formats of precompressed files
  • KTOR-8595 Auth JWK Support (auto-discover)
  • KTOR-9841 OIDC Server Plugin
  • KTOR-9654 Override fetch in JS engine
  • KTOR-9785 Typesafe Authentication DSL
  • KTOR-462 Async CIO DNS resolver with timeout
  • KTOR-9709 Add resource attribute for client resources plugin
  • KTOR-5009 ContentNegotiation: Add a way to prevent changing Accept and Content-Type headers
  • KTOR-9776 OpenAPI: Support the "const" validation keyword
  • KTOR-7468 DefaultConversionService: Support Uuid type introduced in Kotlin 2.0
  • KTOR-9578 HttpCache add method for clearing
  • KTOR-9590 OpenAPI Contextual JSON schema inference support
  • KTOR-6610 Log which ConfigLoader has been used for loading the server configuration
  • KTOR-9735 Commonize HttpCache FileCacheStorage
  • KTOR-8953 WebRTC client on JVM
  • KTOR-9674 UDP support for Node.js targets
  • KTOR-9612 Add text/markdown to the ContentType constants

Improvements

  • KTOR-9876 Typo in KDoc for routing function: "for the this Application".
  • KTOR-9778 Character classification in ktor-http hot paths uses boxed Set lookups and per-symbol encoder allocations
  • KTOR-9702 Duplicate code in ByteReadChannel
  • KTOR-9716 Make ApplicationCallPipeline.ApplicationPhase.Validators public in 3.6.0
  • KTOR-9734 Use TagConsumer in respondHtmlFragment lambda receiver
  • KTOR-5577 Support nullable types in ApplicationCall.receive
  • KTOR-2367 OAuth: clients expect to get authenticated once per "session" for all protected routes
  • KTOR-8594 Auth: Non-optional principal is of nullable type
  • KTOR-9816 Escape $ in application.yaml file
  • KTOR-8193 Unnecessary blocking in OutputStream wrapper

Bugfixes

  • KTOR-8705 testApplication: call coroutine context isn't preserved when responding with ChannelWriterContent
  • KTOR-9248 JWTAuthenticationProvider silently swallows exceptions
  • KTOR-9892 Digest Auth client: nc and qop are not handled according to RFC 7616
  • KTOR-9891 CIO on Kotlin/Native collapses above ~50 connections: HttpHeadersMap pools contend on an allocating SynchronizedObject
  • KTOR-9794 Digest Auth: NullPointerException when the server does not expect Digest auth
  • KTOR-9788 Netty: engine double-responds after its built-in 400, crashing the call-handler coroutine with "Headers can no longer be set because response was already completed"
  • KTOR-9834 HttpClient eagerly initializes SLF4J during Android startup
  • KTOR-9701 Jackson/Gson converters waste time on unnecessary Dispatchers.IO dispatch
  • KTOR-9832 Apache5: Upgrading Apache HttpClient5 to version 5.6 breaks the Ktor client with Content-Length mismatch error for any gzipped content
  • KTOR-9870 OkHttp: Reduce coroutine dispatching and allocations while reading response bodies
  • KTOR-9627 Cancel blocking bridges when coroutine is cancelled
  • KTOR-7067 Ktor Cookie.parseClientCookiesHeader returns Map, which breaks Cookie header contract

... (truncated)

Commits
  • 111c580 Release 3.6.0 (#5882)
  • 1e4186c KTOR-9876 Fix typo in Application.routing KDoc (#5876)
  • 6930eee Fix KTOR-9892 Digest Auth client: nc and qop ... (#5875)
  • 875b2f0 Fix KTOR-9794 Digest Auth: NullPointerException when the server does not expe...
  • dc56137 KTOR-8705 Pass coroutine context to the channel writer (#5868)
  • 55f6e71 Fix KTOR-9640 forward autoFlush in reader/writer helpers
  • 2b04a1f Fix KTOR-9248 JWTAuthenticationProvider silently swallows exceptions (#5877)
  • 702ff9f KTOR-9889 Fix deadlock in concurrent module loading with Dependency Injection...
  • 1fab5f1 Reject Accept entries with q=0 in ContentNegotiation (#5873)
  • b06c3b5 KTOR-9891 Delegate SynchronizedObject to kotlinx.atomicfu on Native (#5874)
  • Additional commits viewable in compare view

Updates io.ktor:ktor-serialization-kotlinx-json from 3.5.2 to 3.6.0

Release notes

Sourced from io.ktor:ktor-serialization-kotlinx-json's releases.

3.6.0

Published 16 September 2026

Features

  • KTOR-8596 OpenID Connect (OAuth2) auto-discover & configuration
  • KTOR-9645 Client curated multi-platform facade module
  • KTOR-8883 Support nested jars in static resources
  • KTOR-8672 Support at least zstd and deflate formats of precompressed files
  • KTOR-8595 Auth JWK Support (auto-discover)
  • KTOR-9841 OIDC Server Plugin
  • KTOR-9654 Override fetch in JS engine
  • KTOR-9785 Typesafe Authentication DSL
  • KTOR-462 Async CIO DNS resolver with timeout
  • KTOR-9709 Add resource attribute for client resources plugin
  • KTOR-5009 ContentNegotiation: Add a way to prevent changing Accept and Content-Type headers
  • KTOR-9776 OpenAPI: Support the "const" validation keyword
  • KTOR-7468 DefaultConversionService: Support Uuid type introduced in Kotlin 2.0
  • KTOR-9578 HttpCache add method for clearing
  • KTOR-9590 OpenAPI Contextual JSON schema inference support
  • KTOR-6610 Log which ConfigLoader has been used for loading the server configuration
  • KTOR-9735 Commonize HttpCache FileCacheStorage
  • KTOR-8953 WebRTC client on JVM
  • KTOR-9674 UDP support for Node.js targets
  • KTOR-9612 Add text/markdown to the ContentType constants

Improvements

  • KTOR-9876 Typo in KDoc for routing function: "for the this Application".
  • KTOR-9778 Character classification in ktor-http hot paths uses boxed Set lookups and per-symbol encoder allocations
  • KTOR-9702 Duplicate code in ByteReadChannel
  • KTOR-9716 Make ApplicationCallPipeline.ApplicationPhase.Validators public in 3.6.0
  • KTOR-9734 Use TagConsumer in respondHtmlFragment lambda receiver
  • KTOR-5577 Support nullable types in ApplicationCall.receive
  • KTOR-2367 OAuth: clients expect to get authenticated once per "session" for all protected routes
  • KTOR-8594 Auth: Non-optional principal is of nullable type
  • KTOR-9816 Escape $ in application.yaml file
  • KTOR-8193 Unnecessary blocking in OutputStream wrapper

Bugfixes

  • KTOR-8705 testApplication: call coroutine context isn't preserved when responding with ChannelWriterContent
  • KTOR-9248 JWTAuthenticationProvider silently swallows exceptions
  • KTOR-9892 Digest Auth client: nc and qop are not handled according to RFC 7616
  • KTOR-9891 CIO on Kotlin/Native collapses above ~50 connections: HttpHeadersMap pools contend on an allocating SynchronizedObject
  • KTOR-9794 Digest Auth: NullPointerException when the server does not expect Digest auth
  • KTOR-9788 Netty: engine double-responds after its built-in 400, crashing the call-handler coroutine with "Headers can no longer be set because response was already completed"
  • KTOR-9834 HttpClient eagerly initializes SLF4J during Android startup
  • KTOR-9701 Jackson/Gson converters waste time on unnecessary Dispatchers.IO dispatch
  • KTOR-9832 Apache5: Upgrading Apache HttpClient5 to version 5.6 breaks the Ktor client with Content-Length mismatch error for any gzipped content
  • KTOR-9870 OkHttp: Reduce coroutine dispatching and allocations while reading response bodies
  • KTOR-9627 Cancel blocking bridges when coroutine is cancelled
  • KTOR-7067 Ktor Cookie.parseClientCookiesHeader returns Map, which breaks Cookie header contract

... (truncated)

Changelog

Sourced from io.ktor:ktor-serialization-kotlinx-json's changelog.

3.6.0

Published 16 September 2026

Features

  • KTOR-8596 OpenID Connect (OAuth2) auto-discover & configuration
  • KTOR-9645 Client curated multi-platform facade module
  • KTOR-8883 Support nested jars in static resources
  • KTOR-8672 Support at least zstd and deflate formats of precompressed files
  • KTOR-8595 Auth JWK Support (auto-discover)
  • KTOR-9841 OIDC Server Plugin
  • KTOR-9654 Override fetch in JS engine
  • KTOR-9785 Typesafe Authentication DSL
  • KTOR-462 Async CIO DNS resolver with timeout
  • KTOR-9709 Add resource attribute for client resources plugin
  • KTOR-5009 ContentNegotiation: Add a way to prevent changing Accept and Content-Type headers
  • KTOR-9776 OpenAPI: Support the "const" validation keyword
  • KTOR-7468 DefaultConversionService: Support Uuid type introduced in Kotlin 2.0
  • KTOR-9578 HttpCache add method for clearing
  • KTOR-9590 OpenAPI Contextual JSON schema inference support
  • KTOR-6610 Log which ConfigLoader has been used for loading the server configuration
  • KTOR-9735 Commonize HttpCache FileCacheStorage
  • KTOR-8953 WebRTC client on JVM
  • KTOR-9674 UDP support for Node.js targets
  • KTOR-9612 Add text/markdown to the ContentType constants

Improvements

  • KTOR-9876 Typo in KDoc for routing function: "for the this Application".
  • KTOR-9778 Character classification in ktor-http hot paths uses boxed Set lookups and per-symbol encoder allocationsDescription has been truncated

@dependabot
Bump the all group with 17 updates
4fe6040 
Bumps the all group with 17 updates:

| Package | From | To |
| --- | --- | --- |
| [org.http4k:http4k-server-netty](https://github.com/http4k/http4k) | `6.59.0.0` | `6.60.0.0` |
| [org.bouncycastle:bcpkix-jdk18on](https://github.com/bcgit/bc-java) | `1.85` | `1.86` |
| [io.heapy.kotaml:kotaml](https://github.com/Heapy/kotaml) | `0.110.0` | `0.111.0` |
| [io.ktor:ktor-client-cio](https://github.com/ktorio/ktor) | `3.5.2` | `3.6.0` |
| [io.ktor:ktor-client-content-negotiation](https://github.com/ktorio/ktor) | `3.5.2` | `3.6.0` |
| [io.ktor:ktor-serialization-kotlinx-json](https://github.com/ktorio/ktor) | `3.5.2` | `3.6.0` |
| [io.ktor:ktor-server-auth-jwt](https://github.com/ktorio/ktor) | `3.5.2` | `3.6.0` |
| [io.ktor:ktor-server-caching-headers](https://github.com/ktorio/ktor) | `3.5.2` | `3.6.0` |
| [io.ktor:ktor-server-call-logging](https://github.com/ktorio/ktor) | `3.5.2` | `3.6.0` |
| [io.ktor:ktor-server-cio](https://github.com/ktorio/ktor) | `3.5.2` | `3.6.0` |
| [io.ktor:ktor-server-content-negotiation](https://github.com/ktorio/ktor) | `3.5.2` | `3.6.0` |
| [io.ktor:ktor-server-default-headers](https://github.com/ktorio/ktor) | `3.5.2` | `3.6.0` |
| [io.ktor:ktor-server-metrics-micrometer](https://github.com/ktorio/ktor) | `3.5.2` | `3.6.0` |
| [io.ktor:ktor-server-resources](https://github.com/ktorio/ktor) | `3.5.2` | `3.6.0` |
| [io.ktor:ktor-server-status-pages](https://github.com/ktorio/ktor) | `3.5.2` | `3.6.0` |
| [io.ktor:ktor-server-test-host](https://github.com/ktorio/ktor) | `3.5.2` | `3.6.0` |
| [io.ktor:ktor-server-websockets](https://github.com/ktorio/ktor) | `3.5.2` | `3.6.0` |


Updates `org.http4k:http4k-server-netty` from 6.59.0.0 to 6.60.0.0
- [Release notes](https://github.com/http4k/http4k/releases)
- [Changelog](https://github.com/http4k/http4k/blob/master/CHANGELOG.md)
- [Commits](http4k/http4k@6.59.0.0...6.60.0.0)

Updates `org.bouncycastle:bcpkix-jdk18on` from 1.85 to 1.86
- [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.md)
- [Commits](https://github.com/bcgit/bc-java/commits)

Updates `io.heapy.kotaml:kotaml` from 0.110.0 to 0.111.0
- [Release notes](https://github.com/Heapy/kotaml/releases)
- [Commits](Heapy/kotaml@v0.110.0...v0.111.0)

Updates `io.ktor:ktor-client-cio` from 3.5.2 to 3.6.0
- [Release notes](https://github.com/ktorio/ktor/releases)
- [Changelog](https://github.com/ktorio/ktor/blob/main/CHANGELOG.md)
- [Commits](ktorio/ktor@3.5.2...3.6.0)

Updates `io.ktor:ktor-client-content-negotiation` from 3.5.2 to 3.6.0
- [Release notes](https://github.com/ktorio/ktor/releases)
- [Changelog](https://github.com/ktorio/ktor/blob/main/CHANGELOG.md)
- [Commits](ktorio/ktor@3.5.2...3.6.0)

Updates `io.ktor:ktor-serialization-kotlinx-json` from 3.5.2 to 3.6.0
- [Release notes](https://github.com/ktorio/ktor/releases)
- [Changelog](https://github.com/ktorio/ktor/blob/main/CHANGELOG.md)
- [Commits](ktorio/ktor@3.5.2...3.6.0)

Updates `io.ktor:ktor-server-auth-jwt` from 3.5.2 to 3.6.0
- [Release notes](https://github.com/ktorio/ktor/releases)
- [Changelog](https://github.com/ktorio/ktor/blob/main/CHANGELOG.md)
- [Commits](ktorio/ktor@3.5.2...3.6.0)

Updates `io.ktor:ktor-server-caching-headers` from 3.5.2 to 3.6.0
- [Release notes](https://github.com/ktorio/ktor/releases)
- [Changelog](https://github.com/ktorio/ktor/blob/main/CHANGELOG.md)
- [Commits](ktorio/ktor@3.5.2...3.6.0)

Updates `io.ktor:ktor-server-call-logging` from 3.5.2 to 3.6.0
- [Release notes](https://github.com/ktorio/ktor/releases)
- [Changelog](https://github.com/ktorio/ktor/blob/main/CHANGELOG.md)
- [Commits](ktorio/ktor@3.5.2...3.6.0)

Updates `io.ktor:ktor-server-cio` from 3.5.2 to 3.6.0
- [Release notes](https://github.com/ktorio/ktor/releases)
- [Changelog](https://github.com/ktorio/ktor/blob/main/CHANGELOG.md)
- [Commits](ktorio/ktor@3.5.2...3.6.0)

Updates `io.ktor:ktor-server-content-negotiation` from 3.5.2 to 3.6.0
- [Release notes](https://github.com/ktorio/ktor/releases)
- [Changelog](https://github.com/ktorio/ktor/blob/main/CHANGELOG.md)
- [Commits](ktorio/ktor@3.5.2...3.6.0)

Updates `io.ktor:ktor-server-default-headers` from 3.5.2 to 3.6.0
- [Release notes](https://github.com/ktorio/ktor/releases)
- [Changelog](https://github.com/ktorio/ktor/blob/main/CHANGELOG.md)
- [Commits](ktorio/ktor@3.5.2...3.6.0)

Updates `io.ktor:ktor-server-metrics-micrometer` from 3.5.2 to 3.6.0
- [Release notes](https://github.com/ktorio/ktor/releases)
- [Changelog](https://github.com/ktorio/ktor/blob/main/CHANGELOG.md)
- [Commits](ktorio/ktor@3.5.2...3.6.0)

Updates `io.ktor:ktor-server-resources` from 3.5.2 to 3.6.0
- [Release notes](https://github.com/ktorio/ktor/releases)
- [Changelog](https://github.com/ktorio/ktor/blob/main/CHANGELOG.md)
- [Commits](ktorio/ktor@3.5.2...3.6.0)

Updates `io.ktor:ktor-server-status-pages` from 3.5.2 to 3.6.0
- [Release notes](https://github.com/ktorio/ktor/releases)
- [Changelog](https://github.com/ktorio/ktor/blob/main/CHANGELOG.md)
- [Commits](ktorio/ktor@3.5.2...3.6.0)

Updates `io.ktor:ktor-server-test-host` from 3.5.2 to 3.6.0
- [Release notes](https://github.com/ktorio/ktor/releases)
- [Changelog](https://github.com/ktorio/ktor/blob/main/CHANGELOG.md)
- [Commits](ktorio/ktor@3.5.2...3.6.0)

Updates `io.ktor:ktor-server-websockets` from 3.5.2 to 3.6.0
- [Release notes](https://github.com/ktorio/ktor/releases)
- [Changelog](https://github.com/ktorio/ktor/blob/main/CHANGELOG.md)
- [Commits](ktorio/ktor@3.5.2...3.6.0)

Updates `io.ktor:ktor-client-content-negotiation` from 3.5.2 to 3.6.0
- [Release notes](https://github.com/ktorio/ktor/releases)
- [Changelog](https://github.com/ktorio/ktor/blob/main/CHANGELOG.md)
- [Commits](ktorio/ktor@3.5.2...3.6.0)

Updates `io.ktor:ktor-serialization-kotlinx-json` from 3.5.2 to 3.6.0
- [Release notes](https://github.com/ktorio/ktor/releases)
- [Changelog](https://github.com/ktorio/ktor/blob/main/CHANGELOG.md)
- [Commits](ktorio/ktor@3.5.2...3.6.0)

Updates `io.ktor:ktor-server-auth-jwt` from 3.5.2 to 3.6.0
- [Release notes](https://github.com/ktorio/ktor/releases)
- [Changelog](https://github.com/ktorio/ktor/blob/main/CHANGELOG.md)
- [Commits](ktorio/ktor@3.5.2...3.6.0)

Updates `io.ktor:ktor-server-caching-headers` from 3.5.2 to 3.6.0
- [Release notes](https://github.com/ktorio/ktor/releases)
- [Changelog](https://github.com/ktorio/ktor/blob/main/CHANGELOG.md)
- [Commits](ktorio/ktor@3.5.2...3.6.0)

Updates `io.ktor:ktor-server-call-logging` from 3.5.2 to 3.6.0
- [Release notes](https://github.com/ktorio/ktor/releases)
- [Changelog](https://github.com/ktorio/ktor/blob/main/CHANGELOG.md)
- [Commits](ktorio/ktor@3.5.2...3.6.0)

Updates `io.ktor:ktor-server-cio` from 3.5.2 to 3.6.0
- [Release notes](https://github.com/ktorio/ktor/releases)
- [Changelog](https://github.com/ktorio/ktor/blob/main/CHANGELOG.md)
- [Commits](ktorio/ktor@3.5.2...3.6.0)

Updates `io.ktor:ktor-server-content-negotiation` from 3.5.2 to 3.6.0
- [Release notes](https://github.com/ktorio/ktor/releases)
- [Changelog](https://github.com/ktorio/ktor/blob/main/CHANGELOG.md)
- [Commits](ktorio/ktor@3.5.2...3.6.0)

Updates `io.ktor:ktor-server-default-headers` from 3.5.2 to 3.6.0
- [Release notes](https://github.com/ktorio/ktor/releases)
- [Changelog](https://github.com/ktorio/ktor/blob/main/CHANGELOG.md)
- [Commits](ktorio/ktor@3.5.2...3.6.0)

Updates `io.ktor:ktor-server-metrics-micrometer` from 3.5.2 to 3.6.0
- [Release notes](https://github.com/ktorio/ktor/releases)
- [Changelog](https://github.com/ktorio/ktor/blob/main/CHANGELOG.md)
- [Commits](ktorio/ktor@3.5.2...3.6.0)

Updates `io.ktor:ktor-server-resources` from 3.5.2 to 3.6.0
- [Release notes](https://github.com/ktorio/ktor/releases)
- [Changelog](https://github.com/ktorio/ktor/blob/main/CHANGELOG.md)
- [Commits](ktorio/ktor@3.5.2...3.6.0)

Updates `io.ktor:ktor-server-status-pages` from 3.5.2 to 3.6.0
- [Release notes](https://github.com/ktorio/ktor/releases)
- [Changelog](https://github.com/ktorio/ktor/blob/main/CHANGELOG.md)
- [Commits](ktorio/ktor@3.5.2...3.6.0)

Updates `io.ktor:ktor-server-test-host` from 3.5.2 to 3.6.0
- [Release notes](https://github.com/ktorio/ktor/releases)
- [Changelog](https://github.com/ktorio/ktor/blob/main/CHANGELOG.md)
- [Commits](ktorio/ktor@3.5.2...3.6.0)

Updates `io.ktor:ktor-server-websockets` from 3.5.2 to 3.6.0
- [Release notes](https://github.com/ktorio/ktor/releases)
- [Changelog](https://github.com/ktorio/ktor/blob/main/CHANGELOG.md)
- [Commits](ktorio/ktor@3.5.2...3.6.0)

---
updated-dependencies:
- dependency-name: org.http4k:http4k-server-netty
  dependency-version: 6.60.0.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: org.bouncycastle:bcpkix-jdk18on
  dependency-version: '1.86'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: io.heapy.kotaml:kotaml
  dependency-version: 0.111.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: io.ktor:ktor-client-cio
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: io.ktor:ktor-client-content-negotiation
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: io.ktor:ktor-serialization-kotlinx-json
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: io.ktor:ktor-server-auth-jwt
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: io.ktor:ktor-server-caching-headers
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: io.ktor:ktor-server-call-logging
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: io.ktor:ktor-server-cio
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: io.ktor:ktor-server-content-negotiation
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: io.ktor:ktor-server-default-headers
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: io.ktor:ktor-server-metrics-micrometer
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: io.ktor:ktor-server-resources
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: io.ktor:ktor-server-status-pages
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: io.ktor:ktor-server-test-host
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: io.ktor:ktor-server-websockets
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: io.ktor:ktor-client-content-negotiation
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: io.ktor:ktor-serialization-kotlinx-json
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: io.ktor:ktor-server-auth-jwt
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: io.ktor:ktor-server-caching-headers
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: io.ktor:ktor-server-call-logging
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: io.ktor:ktor-server-cio
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: io.ktor:ktor-server-content-negotiation
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: io.ktor:ktor-server-default-headers
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: io.ktor:ktor-server-metrics-micrometer
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: io.ktor:ktor-server-resources
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: io.ktor:ktor-server-status-pages
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: io.ktor:ktor-server-test-host
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: io.ktor:ktor-server-websockets
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Sep 20, 2026
@IRus
IRus merged commit f642e7e into main Sep 20, 2026
5 checks passed
@dependabot
dependabot Bot deleted the dependabot/gradle/all-18e7cebc9e branch September 20, 2026 20:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update Java code

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@IRus