Bump the all-dependencies group across 11 directories with 31 updates

[dependabot]

Bumps the all-dependencies group with 6 updates in the / directory:

Package	From	To
gradle-wrapper	9.2.0	9.4.1
com.vanniktech:gradle-maven-publish-plugin	0.35.0	0.36.0
com.gradleup.shadow:com.gradleup.shadow.gradle.plugin	9.3.2	9.4.1
org.jetbrains.kotlinx:atomicfu	0.31.0	0.32.1
com.google.crypto.tink:tink	1.20.0	1.21.0
com.nimbusds:nimbus-jose-jwt	10.8	10.9

Bumps the all-dependencies group with 1 update in the /build-logic directory: com.github.jk1.dependency-license-report:com.github.jk1.dependency-license-report.gradle.plugin.
Bumps the all-dependencies group with 1 update in the /waltid-applications/waltid-cli directory: com.wolpl.clikt-testkit:clikt-testkit.
Bumps the all-dependencies group with 1 update in the /waltid-applications/waltid-openid4vc-ios-testApp/shared directory: io.ktor:ktor-client-darwin.
Bumps the all-dependencies group with 1 update in the /waltid-libraries/credentials/waltid-mdoc-credentials directory: io.mockk:mockk.
Bumps the all-dependencies group with 1 update in the /waltid-libraries/credentials/waltid-mdoc-credentials2 directory: org.jetbrains.kotlinx:kotlinx-serialization-core.
Bumps the all-dependencies group with 2 updates in the /waltid-services/waltid-e2e-tests directory: org.bouncycastle:bcpkix-lts8on and com.nimbusds:nimbus-jose-jwt.
Bumps the all-dependencies group with 1 update in the /waltid-services/waltid-openid4vp-conformance-runners directory: io.ktor:ktor-client-encoding.
Bumps the all-dependencies group with 1 update in the /waltid-services/waltid-verifier-api2 directory: org.bouncycastle:bcprov-lts8on.
Bumps the all-dependencies group with 12 updates in the /waltid-services/waltid-wallet-api directory:

Package	From	To
io.mockk:mockk	1.13.16	1.14.9
de.mkammerer:argon2-jvm	2.11	2.12
org.jetbrains.exposed:exposed-core	1.0.0-rc-1	1.2.0
org.jetbrains.exposed:exposed-jdbc	1.0.0-rc-1	1.2.0
org.jetbrains.exposed:exposed-dao	1.0.0-rc-1	1.2.0
org.jetbrains.exposed:exposed-java-time	1.0.0-rc-1	1.2.0
org.jetbrains.exposed:exposed-json	1.0.0-rc-1	1.2.0
org.xerial:sqlite-jdbc	3.49.0.0	3.51.3.0
org.postgresql:postgresql	42.7.5	42.7.10
com.mysql:mysql-connector-j	9.2.0	9.6.0
com.interaso:webpush	1.2.0	1.3.0
com.sksamuel.hoplite:hoplite-core	2.8.0	2.9.0

Bumps the all-dependencies group with 3 updates in the /waltid-services/waltid-web3login-microservice directory: jvm, io.ktor.plugin and org.jetbrains.kotlin.plugin.serialization.

Updates gradle-wrapper from 9.2.0 to 9.4.1

Release notes

Sourced from gradle-wrapper's releases.

9.4.1

The Gradle team is excited to announce Gradle 9.4.1.

Here are the highlights of this release:

• Java 26 support
• Non-class-based JVM tests
• Enhanced console progress bar

Read the Release Notes

We would like to thank the following community members for their contributions to this release of Gradle: akankshaa-00, Attila Kelemen, Björn Kautler, dblood, Dennis Rieks, duvvuvenkataramana, John Burns, Julian, kevinstembridge, Niels Doucet, Philip Wedemann, ploober, Richard Hernandez, Roberto Perez Alcolea, Sebastian Lövdahl, stephan2405, Stephane Landelle, Ujwal Suresh Vanjare, Victor Merkulov, Vincent Potuček, Vladimir Sitnikov.

Upgrade instructions

Switch your build to use Gradle 9.4.1 by updating your wrapper:

./gradlew wrapper --gradle-version=9.4.1 && ./gradlew wrapper

See the Gradle 9.x upgrade guide to learn about deprecations, breaking changes and other considerations when upgrading.

For Java, Groovy, Kotlin and Android compatibility, see the full compatibility notes.

Reporting problems

If you find a problem with this release, please file a bug on GitHub Issues adhering to our issue guidelines. If you're not sure you're encountering a bug, please use the forum.

We hope you will build happiness with Gradle, and we look forward to your feedback via Twitter or on GitHub.

... (truncated)

Commits

• 2d63270 Ignore test (#37180)
• 4c15906 Ignore test
• 9759ac1 Make console/SIGINT test deterministic (#37178)
• aaf6ed4 Make console/SIGINT test deterministic
• 47cb783 Fix OSC 9;4 progress bar not cleared on SIGINT (#37038)
• ef03f1d Fix order-dependent assertion in CrossBuildScriptCachingIntegrationSpec
• fd26fd3 Fix OSC 9;4 taskbar progress bar not cleared on build end or SIGINT
• 0a84d67 Release notes for 9.4.1 (#37148)
• e569c31 cleanup
• 9f227de cleanup
• Additional commits viewable in compare view

Updates com.vanniktech:gradle-maven-publish-plugin from 0.35.0 to 0.36.0

Release notes

Sourced from com.vanniktech:gradle-maven-publish-plugin's releases.

0.36.0

BREAKING

• Updated minimum supported JDK, Gradle, Android Gradle Plugin and Kotlin versions.
• Removed support for Dokka v1, it's now required to use Dokka in v2 mode.
• Mark DirectorySignatureType internal.

Behavior changes

• validateDeployment now has the DeploymentValidation enum as type instead of being a boolean. The default is now to just wait for the VALIDATED state. The previous behavior can be achieved by setting it to PUBLISHED. NONE can be used for disabling the validation completely.
• When calling configure(...) manually to configure what to publish and not passing javadocJar explicity, the plugin now defaults to publishing an empty javadoc jar.

Features

• Android projects now support using Dokka for javadoc creation, this will happen automatically when using the default options and the Dokka plugin is applied to the project.
• Added consistent JavadocJar and SourcesJar options to configureBasedOnAppliedPlugins and to all applicable project types that can be passed to configure. The previous Boolean based versions have been deprecated.
• When enabling Maven Central publishing through the DSL, the mavenCentralDeploymentValidation and mavenCentralAutomaticPublishing are used for the default values of the 2 parameters when they are not passed explicitly. This allows to more easily override them in certain environments.
• When isolated projects is enabled the module/project specific gradle.properties files are now considered in the same way they are when isolated projects is disabled.

Improvements

• Better error message when Maven Central credentials are missing.

Minimum supported versions

• JDK 17
• Gradle 9.0.0
• Android Gradle Plugin 8.13.0
• Kotlin Gradle Plugin 2.2.0

Compatibility tested up to

• JDK 25
• Gradle 9.3.0
• Gradle 9.4.0-milestone-4
• Android Gradle Plugin 8.13.2
• Android Gradle Plugin 9.0.0
• Android Gradle Plugin 9.1.0-alpha05
• Kotlin Gradle Plugin 2.3.0
• Kotlin Gradle Plugin 2.3.20-Beta1

0.36.0-rc2

BREAKING

• Updated minimum supported JDK, Gradle, Android Gradle Plugin and Kotlin versions.
• Removed support for Dokka v1, it's now required to use Dokka in v2 mode.
• Mark DirectorySignatureType internal.

... (truncated)

Changelog

Sourced from com.vanniktech:gradle-maven-publish-plugin's changelog.

0.36.0 (2026-01-13)

BREAKING

• Updated minimum supported JDK, Gradle, Android Gradle Plugin and Kotlin versions.
• Removed support for Dokka v1, it's now required to use Dokka in v2 mode.
• Mark DirectorySignatureType internal.

Behavior changes

• validateDeployment now has the DeploymentValidation enum as type instead of being a boolean. The default is now to just wait for the VALIDATED state. The previous behavior can be achieved by setting it to PUBLISHED. NONE can be used for disabling the validation completely.
• When calling configure(...) manually to configure what to publish and not passing javadocJar explicity, the plugin now defaults to publishing an empty javadoc jar.

Features

• Android projects now support using Dokka for javadoc creation, this will happen automatically when using the default options and the Dokka plugin is applied to the project.
• Added consistent JavadocJar and SourcesJar options to configureBasedOnAppliedPlugins and to all applicable project types that can be passed to configure. The previous Boolean based versions have been deprecated.
• When enabling Maven Central publishing through the DSL, the mavenCentralDeploymentValidation and mavenCentralAutomaticPublishing are used for the default values of the 2 parameters when they are not passed explicitly. This allows to more easily override them in certain environments.
• When isolated projects is enabled the module/project specific gradle.properties files are now considered in the same way they are when isolated projects is disabled.

Improvements

• Better error message when Maven Central credentials are missing.

Minimum supported versions

• JDK 17
• Gradle 9.0.0
• Android Gradle Plugin 8.13.0
• Kotlin Gradle Plugin 2.2.0

Compatibility tested up to

• JDK 25
• Gradle 9.3.0
• Gradle 9.4.0-milestone-4
• Android Gradle Plugin 8.13.2
• Android Gradle Plugin 9.0.0
• Android Gradle Plugin 9.1.0-alpha05
• Kotlin Gradle Plugin 2.3.0
• Kotlin Gradle Plugin 2.3.20-Beta1

Commits

• 0a5fa58 rc2 and wait for published
• 695e18a rc1
• f92dc3a Changelog for 0.36.0
• bddd1e6 Update dependency org.jetbrains.kotlin.jvm to v2.3.20-Beta1 (#1289)
• 22f90b2 Update Gradle to v9.3.0 (#1301)
• d7d5f34 Update android.gradle to v9 (major) (#1298)
• 3d262a6 Update dependency com.android.library to v9.1.0-alpha05 (#1300)
• a8573ed Update plugin com.gradle.develocity to v4.3.1 (#1299)
• ee0f2e3 Fix typo in default DeploymentValidation and correct documentation (#1296)
• 783599f Update dependency com.android.library to v9.0.0 (#1297)
• Additional commits viewable in compare view

Updates com.gradleup.shadow:com.gradleup.shadow.gradle.plugin from 9.3.2 to 9.4.1

Release notes

Sourced from com.gradleup.shadow:com.gradleup.shadow.gradle.plugin's releases.

9.4.1

Changed

• Update Kotlin to 2.3.20. (#1978)

9.4.0

Added

• Support Isolated Projects. (#1139)

Changed

• Allow opting out of adding shadowJar into assemble lifecycle. (#1939)

  shadow {
    // Disable making `assemble` task depend on `shadowJar`. This is enabled by default.
    addShadowJarToAssembleLifecycle = false
  }

• Stop catching ZipException when writing entries. (#1970)

Fixed

• Fix interaction with Gradle artifact transforms. (#1345)
• Fix skipStringConstants per-relocator behavior in mapName. (#1968)
• Fix failing for non-existent class directories. (#1976)

Commits

• f98d8f2 Prepare version 9.4.1
• 7cf1ac5 Note #1978 in changelog
• 539d532 Update plugin jetbrains-dokka to v2.2.0 (#1994)
• 0fb99ca Update actions/deploy-pages action to v5 (#1993)
• 38ec3e2 Update Develocity to v4.4.0 (#1992)
• e519072 Update gradle/actions action to v6 (#1990)
• ca0dd71 Update pluginPublish to v2.1.1 (#1989)
• 5a1ab58 Update Gradle to v9.4.1 (#1988)
• 69dfdfc Improve file type check for AAR (#1987)
• 1395087 Document excluding non-JAR transitive dependencies (#1986)
• Additional commits viewable in compare view

Updates org.jetbrains.kotlinx:atomicfu from 0.31.0 to 0.32.1

Release notes

Sourced from org.jetbrains.kotlinx:atomicfu's releases.

0.32.1

0.32.1 is identical to 0.32.0 and it only includes infra updates required to publish the Gradle plugin to Gradle Plugin Portal.

0.32.0

• SynchronizedObject implementation was reverted to version 0.29.0 to resolve a performance regression (See #584 for details)

[!NOTE] AtomicFU Gradle plugin with version 0.32.0 was not published in the Gradle Plugin Portal.

Changelog

Sourced from org.jetbrains.kotlinx:atomicfu's changelog.

Version 0.32.1

• Fixed issues with the Gradle plugin publication to the Gradle plugin portal (#589)

Version 0.32.0

• SynchronizedObject implementation was reverted to version 0.29.0 to resolve a performance regression (See #584 for details)

Commits

• 1d625ed Version 0.32.1
• 8310a33 Update publish plugin and declare configuration cache compatibility (#589)
• 06cb5bc Version 0.32.0
• 50ec99b Validate published artifacts (#572)
• 4a8f65c Revert SynchronizedObject implementation (#587)
• 5917f3a Use fixed AV/LV for the Gradle plugin and transformer (#588)
• d45af1e Deprecation of apple x64 targets as error (#585)
• e01d1e2 Fix CustomCountDownLatch (#577)
• 0e1a448 Remove effectively unused and broken settings.gradle.kts (#580)
• See full diff in compare view

Updates com.google.crypto.tink:tink from 1.20.0 to 1.21.0

Release notes

Sourced from com.google.crypto.tink:tink's releases.

Tink Java v1.21.0

Tink is a multi-language, cross-platform library that provides simple and misuse-proof APIs for common cryptographic tasks.

This is Tink Java 1.21.0

The complete list of changes since 1.20.0 can be found here.

• Added methods addAnnotations to KeysetHandle.Builder and getAnnotationsOrNull to KeysetHandle. This allows attaching arbitrary information to a KeysetHandle, which can be useful when one has deep stacks.
• A set of accessor methods in RawJwt has been made public.
• Added general support for ML-DSA-87.
• SignaturePemKeysetReader now supports ML-DSA-65, ML-DSA-87 and Ed25519.
• Added buildPublicKeysetHandle method to SignaturePemKeysetReader.Builder, which replaces the deprecated build method.

Maven:

<dependency>
    <groupId>com.google.crypto.tink</groupId>
    <artifactId>tink</artifactId>
    <version>1.21.0</version>
</dependency>

Gradle:

dependencies {
  implementation 'com.google.crypto.tink:tink-android:1.21.0'
}

Bazel:

Using bzlmod

bazel_dep(name = "tink_java")
git_override(

module_name = "tink_java",

remote = "https://github.com/tink-crypto/tink-java",

tag = "v1.21.0",

)

Commits

• 0be5717 Bump tink-java version to 1.21.0
• def2eff Improve error reporting in SignaturePemKeysetReader.
• 65e722a Introduce CompositeMlDsa parameters to Tink Java.
• 68a030c Add support for ML-DSA-87 in SignaturePemKeysetReader.
• 484229d Fix the Java Doc comment to reflect the introduction of ML-DSA-87.
• 43f0886 Automated change
• 1efca99 Declare variables on their first use.
• 18cee3b Deprecate SignaturePemKeysetReader.Builder.build.
• 9817254 Automated change
• 1b1cfde Automated change.
• Additional commits viewable in compare view

Updates com.nimbusds:nimbus-jose-jwt from 10.8 to 10.9

Changelog

Sourced from com.nimbusds:nimbus-jose-jwt's changelog.

version 1.0 (2012-03-01)

• First version based on the OpenInfoCard JWT, JWS and JWE code base.

version 1.1 (2012-03-06)

• Introduces type-safe enumeration of the JSON Web Algorithms (JWA).
• Refactors the JWT class.

version 1.2 (2012-03-08)

• Moves JWS and JWE code into separate classes.

version 1.3 (2012-03-09)

• Switches to Apache Commons Codec for Base64URL encoding and decoding
• Consolidates the crypto utilities within the package.
• Introduces a JWT content serialiser class.

version 1.4 (2012-03-09)

• Refactoring of JWT class and JUnit tests.

version 1.5 (2012-03-18)

• Switches to JSON Smart for JSON serialisation and parsing.
• Introduces claims set class with JSON objects, string, Base64URL and byte array views.

version 1.6 (2012-03-20)

• Creates class for representing, serialising and parsing JSON Web Keys (JWK).
• Introduces separate class for representing JWT headers.

version 1.7 (2012-04-01)

• Introduces separate classes for plain, JWS and JWE headers.
• Introduces separate classes for plain, signed and encrypted JWTs.
• Removes the JWTContent class.
• Removes password-based (PE820) encryption support.

version 1.8 (2012-04-03)

• Adds support for the ZIP JWE header parameter.
• Removes unsupported algorithms from the JWA enumeration.

version 1.9 (2012-04-03)

• Renames JWEHeader.{get|set}EncryptionAlgorithm() to JWEHeader.{get|set}EncryptionMethod().

version 1.9.1 (2012-04-03)

• Upgrades JSON Smart JAR to 1.1.1.

version 1.10 (2012-04-14)

• Introduces serialize() method to base abstract JWT class.

version 1.11 (2012-05-13)

• JWT.serialize() throws checked JWTException instead of

... (truncated)

Commits

• e48aa07 [maven-release-plugin] prepare for next development iteration
• 4b02531 Adds X509CertUtils.computeSHA1Thumbprint(X509Certificate) method
• 6b52455 [maven-release-plugin] prepare release 10.9
• See full diff in compare view

Updates com.nimbusds:nimbus-jose-jwt from 10.8 to 10.9

Changelog

Sourced from com.nimbusds:nimbus-jose-jwt's changelog.

version 1.0 (2012-03-01)

• First version based on the OpenInfoCard JWT, JWS and JWE code base.

version 1.1 (2012-03-06)

• Introduces type-safe enumeration of the JSON Web Algorithms (JWA).
• Refactors the JWT class.

version 1.2 (2012-03-08)

• Moves JWS and JWE code into separate classes.

version 1.3 (2012-03-09)

• Switches to Apache Commons Codec for Base64URL encoding and decoding
• Consolidates the crypto utilities within the package.
• Introduces a JWT content serialiser class.

version 1.4 (2012-03-09)

• Refactoring of JWT class and JUnit tests.

version 1.5 (2012-03-18)

• Switches to JSON Smart for JSON serialisation and parsing.
• Introduces claims set class with JSON objects, string, Base64URL and byte array views.

version 1.6 (2012-03-20)

• Creates class for representing, serialising and parsing JSON Web Keys (JWK).
• Introduces separate class for representing JWT headers.

version 1.7 (2012-04-01)

• Introduces separate classes for plain, JWS and JWE headers.
• Introduces separate classes for plain, signed and encrypted JWTs.
• Removes the JWTContent class.
• Removes password-based (PE820) encryption support.

version 1.8 (2012-04-03)

• Adds support for the ZIP JWE header parameter.
• Removes unsupported algorithms from the JWA enumeration.

version 1.9 (2012-04-03)

• Renames JWEHeader.{get|set}EncryptionAlgorithm() to JWEHeader.{get|set}EncryptionMethod().

version 1.9.1 (2012-04-03)

• Upgrades JSON Smart JAR to 1.1.1.

version 1.10 (2012-04-14)

• Introduces serialize() method to base abstract JWT class.

version 1.11 (2012-05-13)

• JWT.serialize() throws checked JWTException instead of

... (truncated)

Commits

• e48aa07 [maven-release-plugin] prepare for next development iteration
• 4b02531 Adds X509CertUtils.computeSHA1Thumbprint(X509Certificate) method
• 6b52455 [maven-release-plugin] prepare release 10.9
• See full diff in compare view

Updates com.github.jk1.dependency-license-report:com.github.jk1.dependency-license-report.gradle.plugin from 3.0.1 to 3.1.2

Updates com.github.jk1.dependency-license-report:com.github.jk1.dependency-license-report.gradle.plugin from 3.0.1 to 3.1.2

Updates com.wolpl.clikt-testkit:clikt-testkit from 3.0.0 to 3.1.1

Release notes

Sourced from com.wolpl.clikt-testkit:clikt-testkit's releases.

3.1.1

The library is now compiled with Java 11 again.

The previous release was compiled with Java 21, which broke using it in some projects.

3.1.0

Support for testing SuspendingCliktCommand implementations.

Commits

• 30bd776 Set version to 3.1.1.
• 44ac62c Reset JVM toolchain to version 11.
• 0cf3c2c Replace Gradle action and disable daemon creation.
• 37a7629 Set version to 3.2.0-SNAPSHOT.
• 10b43c6 Set version to 3.1.0.
• 0c22c28 Update to Java 21.
• 5aec61e Set version to 3.0.1-SNAPSHOT and update release action for the new Maven Cen...
• 79d8ce2 Migrate publishing to the new Maven Central API.
• 9f6b029 Set version 3.1.0
• d967c5a Update publishing URLs.
• Additional commits viewable in compare view

Updates io.ktor:ktor-client-darwin from 3.2.3 to 3.4.2

Release notes

Sourced from io.ktor:ktor-client-darwin's releases.

3.4.2

Published 27 March 2026

Improvements

• KTOR-9327 Curl: The WebSockets maxFrameSize option does not have an effect
• KTOR-9383 CaseInsensitiveString: reduce allocations
• KTOR-9385 Netty: Allocation micro-optimizations
• KTOR-9403 Darwin: Unnecessary ByteArray copy for each received response chunk
• KTOR-9412 KDoc for formFieldLimit documents incorrect default value (64 KB instead of 50 MiB)

Bugfixes

• KTOR-9351 OpenAPI: Incorrect schema generated for nested classes with lists
• KTOR-9361 WebSockets: JsWebSocketSession._closeReason is completed twice
• KTOR-9437 Fix GraalVM Compatibility
• KTOR-9424 Logging: OkHttp format should log the full requested URL
• KTOR-8540 Logging: IllegalStateException is thrown when response is cached and deserialization fails
• KTOR-9370 OpenAPI: NoSuchMethodError - getLOCAL_FUNCTION_FOR_LAMBDA with Kotlin 2.3.20-*
• KTOR-9421 Netty: active SSE connection blocks HTTP/2 response flushing for other requests
• KTOR-3390 JS browser: "Failed to execute 'digest' on 'SubtleCrypto'" error when using digest auth
• KTOR-5977 Compression: The encoders buffer streaming response
• KTOR-9393 Certificate pinning matches against all pins instead of hostname-scoped pins
• KTOR-8751 DI: AmbiguousDependencyException when named dependency is overridden in testApplication
• KTOR-9039 Bearer Auth: Request body transformed with jsonIO isn't sent over again after refreshToken request
• KTOR-9404 Darwin: Memory leak in KtorNSURLSessionDelegate
• KTOR-9399 LinkageError when running Ktor app with development mode inside Spring Boot / Amper fat-JAR
• KTOR-9402 NoSuchMethodError on RawWebSocket after 3.4.0
• KTOR-9372 Frame.Text.readText() causes infinite loop and 100% CPU on Kotlin/Native when WebSocket frame data is malformed or connection drops unexpectedly
• KTOR-9387 ZstdEncoder decode fails when source data is split into multiple Zstd frames

3.4.1

Published 3 March 2026

Improvements

• KTOR-9382 HttpProtocolVersion.parse: fast path for common versions
• KTOR-9381 GMTDate: reduce allocations
• KTOR-8971 Support "operationId" in Kdoc for OpenAPI spec. gen.
• KTOR-9333 WebSockets: Infinite spin and potential OOM vulnerabilities in the Inflater.inflateFully method
• KTOR-5616 Ktor always adds by default an Accept-Charset header
• KTOR-9291 OpenAPI: handle atypical route functions
• KTOR-9293 OpenAPI describe needs defaults
• KTOR-9304 OpenAPI: Order of path parameters is not preserved in the spec
• KTOR-9353 Routing: TailcardSelector missing toString(), which clutters the logs

Bugfixes

• KTOR-9281 OpenApi code inference misses lambda argument bodies
• KTOR-9273 OpenAPI static content path appears in resulting model
• KTOR-9004 OpenAPI: No respective formats detected for serializable types like UUID or Instant
• KTOR-9305 OpenAPI: "No mapping for symbol: VAR FOR_LOOP_VARIABLE" error with codeInferenceEnabled=true
• KTOR-9279 OpenAPI: UnsupportedOperationException for a function with a reified type parameter codeInferenceEnabled = true
• KTOR-9289 OpenAPI: Resource routes are missing inferred and comment-based documentation

... (truncated)

Changelog

Sourced from io.ktor:ktor-client-darwin's changelog.

3.4.2

Published 27 March 2026

Improvements

• KTOR-9327 Curl: The WebSockets maxFrameSize option does not have an effect
• KTOR-9383 CaseInsensitiveString: reduce allocations
• KTOR-9385 Netty: Allocation micro-optimizations
• KTOR-9403 Darwin: Unnecessary ByteArray copy for each received response chunk
• KTOR-9412 KDoc for formFieldLimit documents incorrect default value (64 KB instead of 50 MiB)

Bugfixes

• KTOR-9351 OpenAPI: Incorrect schema generated for nested classes with lists
• KTOR-9361 WebSockets: JsWebSocketSession._closeReason is completed twice
• KTOR-9437 Fix GraalVM Compatibility
• KTOR-9424 Logging: OkHttp format should log the full requested URL
• KTOR-8540 Logging: IllegalStateException is thrown when response is cached and deserialization fails
• KTOR-9370 OpenAPI: NoSuchMethodError - getLOCAL_FUNCTION_FOR_LAMBDA with Kotlin 2.3.20-*
• KTOR-9421 Netty: active SSE connection blocks HTTP/2 response flushing for other requests
• KTOR-3390 JS browser: "Failed to execute 'digest' on 'SubtleCrypto'" error when using digest auth
• KTOR-5977 Compression: The encoders buffer streaming response
• KTOR-9393 Certificate pinning matches against all pins instead of hostname-scoped pins
• KTOR-8751 DI: AmbiguousDependencyException when named dependency is overridden in testApplication
• KTOR-9039 Bearer Auth: Request body transformed with jsonIO isn't sent over again after refreshToken request
• KTOR-9404 Darwin: Memory leak in KtorNSURLSessionDelegate
• KTOR-9399 LinkageError when running Ktor app with development mode inside Spring Boot / Amper fat-JAR
• KTOR-9402 NoSuchMethodError on RawWebSocket after 3.4.0
• KTOR-9372 Frame.Text.readText() causes infinite loop and 100% CPU on Kotlin/Native when WebSocket frame data is malformed or connection drops unexpectedly
• KTOR-9387 ZstdEncoder decode fails when source data is split into multiple Zstd frames

3.4.1

Published 3 March 2026

Improvements

• KTOR-9382 HttpProtocolVersion.parse: fast path for common versions
• KTOR-9381 GMTDate: reduce allocations
• KTOR-8971 Support "operationId" in Kdoc for OpenAPI spec. gen.
• KTOR-9333 WebSockets: Infinite spin and potential OOM vulnerabilities in the Inflater.inflateFully method
• KTOR-5616 Ktor always adds by default an Accept-Charset header
• KTOR-9291 OpenAPI: handle atypical route functions
• KTOR-9293 OpenAPI describe needs defaults
• KTOR-9304 OpenAPI: Order of path parameters is not preserved in the spec
• KTOR-9353 Routing: TailcardSelector missing toString(), which clutters the logs

Bugfixes

• KTOR-9281 OpenApi code inference misses lambda argument bodies
• KTOR-9273 OpenAPI static content path appears in resulting model
• KTOR-9004 OpenAPI: No respective formats detected for serializable types like UUID or Instant
• KTOR-9305 OpenAPI: "No mapping for symbol: VAR FOR_LOOP_VARIABLE" error with codeInferenceEnabled=true
• KTOR-9279 OpenAPI: UnsupportedOperationException for a function with a reified type parameter codeInferenceEnabled = true

... (truncated)

Commits

• 245774a Release 3.4.2 (#5493)
• 7c6c33a KTOR-9361 Fix JsWebSocketSession._closeReason completed twice (#5457)
• 453e739 KTOR-9437 Server. Add GraalVM metadata. (#5491)
• 7146fd7 KTOR-9424 Log full URLs with OkHttp format (#5488)
• 52b5981 KTOR-8540 Fix IllegalStateException by creating a new instance of HttpClientC...
• 12de7fb KTOR-9408 Update atomicfu with performance fix
• 58837ad KTOR-9419 Fix vulnerability in swagger endpoint
• 69e55ce Remove CurlWebSocketTests (#5483)
• 5dfbe51 fixup! KTOR-9421 Track streaming responses separately to fix SSE blocking flu...
• e784ed7 fixup! Server. Update KDocs for that may set status. (#5233)
• Additional commits viewable in compare view

Updates io.mockk:mockk from 1.13.16 to 1.14.9

Release notes

Sourced from io.mockk:mockk's releases.

v1.14.9

What's Changed

• fix: normalize value class arguments in EqMatcher for consistent comparison by @​edwardmp in mockk/mockk#1440
• Add configurable logging to withArg & withNullableArg by @​OsaSoft in mockk/mockk#1441
• docs(readme): document suppressing superclass calls by @​ch200203 in mockk/mockk#1444
• Fix for issue #1103. by @​sdetilly in mockk/mockk#1449
• Fix configuration option example for restricted classes by @​TWiStErRob in mockk/mockk#1465
• Fix InaccessibleObjectException when spying on JDK interfaces on JDK 16+ by @​Copilot in mockk/mockk#1457
• Fix Java 11 compatibility: replace Random.nextLong(long, long) with Java 8 compatible alternative by @​Copilot in mockk/mockk#1456
• Add optional restricted mock system property by @​nishatoma in mockk/mockk#1454
• Fix StackOverflowError when mocking methods returning ArrayList by @​Copilot in mockk/mockk#1464
• Change JUnit 4/5 dependencies from implementation to compileOnly by @​Copilot in mockk/mockk#1455
• bump dependencies, bump dexter by @​jgrnrt in mockk/mockk#1477
• Fix issue 1475: nullable value class verification by @​sdetilly in mockk/mockk#1480
• Migrate build configuration to version catalog by @​jgrnrt in mockk/mockk#1481
• Clean up CI configuration and build artifacts by @​jgrnrt in mockk/mockk#1482
• Add Spotless formatting plugin by @​jgrnrt in mockk/mockk#1483
• Enable ktlint unused-imports rule and clean up code by @​jgrnrt in mockk/mockk#1489
• chore: enable no-wildcard-imports in ktlint by @​jgrnrt in mockk/mockk#1491
• Add List injection support for @​InjectMockKs (#1356) by @​h2jinee in mockk/mockk#1492
• Unify settings files by prioritizing mockk.properties in MockKSettings by @​snowykte0426 in mockk/mockk#1474
• Fix type matching for any() when parameter is Any (#1296) by @​chapakook in mockk/mockk#1494
• Upgrade Dokka to 2.1.0 and Refactor Documentation Setup by @​jgrnrt in mockk/mockk#1499
• chore: bump gradle to 9.3.0, add .gitattributes by @​jgrnrt in mockk/mockk#1502
• Fix #1342: Handle value classes for type parameters and don't unbox value classes returned as interface/supertype by @​ianbrandt in mockk/mockk#1442
• Introduce clearAllStubsFromMemory by @​nishatoma in mockk/mockk#1503
• Bump dokka to 2.2.0-Beta by @​jgrnrt in mockk/mockk#1505
• fix: resolve @​InjectMockKs initialization order based on dependencies by @​neungs-2 in mockk/mockk#1500

New Contributors

• @​edwardmp made their first contribution in mockk/mockk#1440
• @​OsaSoft made their first contribution in mockk/mockk#1441
• @​sdetilly made their first contribution in mockk/mockk#1449
• @​Copilot made their first contribution in mockk/mockk#1457
• @​nishatoma made their first contribution in mockk/mockk#1454
• @​jgrnrt made their first contribution in mockk/mockk#1477
• @​h2jinee made their first contribution in mockk/mockk#1492
• @​snowykte0426 made their first contribution in mockk/mockk#1474
• @​chapakook made their first contribution in mockk/mockk#1494
• @​ianbrandt made their first contribution in mockk/mockk#1442
• @​neungs-2 made their first contribution in mockk/mockk#1500

Full Changelog: mockk/mockk@1.14.6...1.14.9

v1.14.7

What's Changed

• fix: normalize value class arguments in EqMatcher for consistent comparison by @​edwardmp in mockk/mockk#1440
• Add configurable logging to withArg & withNullableArg by @​OsaSoft in mockk/mockk#1441
• docs(readme): document suppressing superclass calls by @​ch200203 in mockk/mockk#1444
• Fix for issue #1103. by @​sdetilly in mockk/mockk#1449

... (truncated)

Commits

• 71a8e21 Release v1.14.9 and bump versions
• cd84546 Merge pull request #1500 from neungs-2/master
• 79b507a Merge pull request #1505 from jgrnrt/fix-dokka-2
• 373f95b bump dokka to 2.2.0-Beta to fix "ERROR CLASS: Symbol not found" in generated ...
• dbd755c docs: @​InjectMockKs dependency order
• e4ff90b Merge pull request #1503 from nishatoma/add-clear-memory-method
• 4a7d481 fix: add backward compatible method for MockInitializer
• db40a01 Merge pull request #1442 from ianbrandt/issue-1342
• 9249fbf Replaced MethodHandle usage with Method for value class unboxing to suppo...
• a34d4d9 Updated the :test-modules:client-tests Kotlinx Coroutines dependency versio...
• Additional commits viewable in compare view

Updates io.mockk:mockk from 1.13.16 to 1.14.9

Release notes

Sourced from io.mockk:mockk's releases.

v1.14.9

What's Changed

• fix: normalize value...

  Description has been truncated

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud