fix: upgrade Ktor for coroutines 1.11

[zhukaihan]

Summary

• upgrade Ktor from 2.3.12 to 3.3.3 and align Kotlin 2.2.21, kotlinx.serialization 1.9.0, and coroutines 1.11.0
• upgrade the Gradle wrapper to 8.11.1 and migrate to the Kotlin compilerOptions DSL
• migrate affected server APIs and replace the removed Ktor server test artifact
• add a real OkHttp-engine regression test and a Ktor 3 testApplication request-body test

Ktor 3 migration guide audit

Verified against the official guide: https://ktor.io/docs/migrating-3.html

Applicable changes:

• CallLogging moved from io.ktor.server.plugins.callloging to io.ktor.server.plugins.calllogging
• Ktor moved ByteReadChannel internals to kotlinx-io, removing the old io.ktor.util.toByteArray helper used for request bodies

The repository does not use the other affected APIs in the guide: legacy ApplicationEngineEnvironment builders, withTestApplication/withApplication, Locations, WebSockets duration configuration, socket bind, multipart/file APIs, session encryption, HttpResponse.content, SocketTimeoutException, AttributeKey type mismatches, or the removed empty io.ktor:ktor artifact. The existing embeddedServer and streamed cohort bodyAsChannel/toInputStream paths compile and test successfully on Ktor 3.3.3.

Compiler verification also identified required Ktor 3.3.3 adjustments for ShutDownUrl and ktor-server-test-host.

Verification

• ./gradlew clean ktlintCheck test assemble --no-daemon
• 125 tests, 0 failures
• real loopback request through the Ktor OkHttp engine with coroutines 1.11.0
• resolved runtime graph selects Ktor 3.3.3 and coroutines 1.11.0
• Dokka, Javadoc jar, Gradle metadata, and Maven POM generation pass
• isolated Kotlin 2.2 downstream consumer compiles against the generated evaluation-proxy-core jar

Context: https://amplitude.slack.com/archives/C016HQFUASD/p1787608443150739

---

Note

Medium Risk
Large dependency bump (Ktor 2→3, Kotlin 2.2) changes how POST evaluation requests read JSON bodies; risk is mitigated by targeted tests but still warrants careful review of vardata POST paths.

Overview
Upgrades the build stack to Kotlin 2.2.21, Ktor 3.3.3, kotlinx-coroutines 1.11.0, and kotlinx-serialization 1.9.0, with Gradle 8.11.1 and the Kotlin compilerOptions JVM target DSL replacing deprecated kotlinOptions.

Ktor 3 follow-ups in runtime code: CallLogging import package fix, ShutDownUrl constructor API, and POST user parsing now uses call.receiveText() instead of the removed io.ktor.util.toByteArray on the request channel. Service tests switch from ktor-server-tests-jvm to ktor-server-test-host-jvm.

Adds regression coverage: a loopback OkHttp ProjectApi test (coroutines 1.11) and a testApplication test for getUserFromBody.

^{Reviewed by Cursor Bugbot for commit 34ce619. Bugbot is set up for automated code reviews on this repo. Configure here.}

[Copilot]

Pull request overview

Upgrades the Kotlin/Ktor stack for coroutines 1.11 compatibility and migrates affected server APIs and build configuration.

Changes:

• Upgrades Ktor, Kotlin, serialization, coroutines, and Gradle.
• Migrates Ktor 3 request-body, logging, shutdown, and test APIs.
• Adds regression tests for POST body parsing and the OkHttp engine.

Reviewed changes

Copilot reviewed 11 out of 13 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
build.gradle.kts	Updates the root Kotlin plugin.
gradle.properties	Centralizes upgraded dependency versions.
gradle/wrapper/gradle-wrapper.properties	Upgrades Gradle to 8.11.1.
gradlew	Updates the Unix wrapper script.
gradlew.bat	Updates the Windows wrapper script.
core/build.gradle.kts	Migrates compiler settings and serialization plugin.
core/src/main/kotlin/cohort/CohortApi.kt	Removes an obsolete Ktor import.
core/src/test/kotlin/project/ProjectApiTest.kt	Adds a real OkHttp regression test.
service/build.gradle.kts	Upgrades plugins and replaces the server test artifact.
service/src/main/kotlin/Server.kt	Migrates request-body and shutdown APIs.
service/src/main/kotlin/plugins/Monitoring.kt	Updates the CallLogging package.
service/src/test/kotlin/ServerTest.kt	Tests Ktor 3 request-body parsing.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[vaibhav-jain-exp]

LGTM! Verify load test runs before merging.