Skip to content

⬆️ Bump ktor from 3.5.2 to 3.6.0 - #5059

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/gradle/ktor-3.6.0
Closed

⬆️ Bump ktor from 3.5.2 to 3.6.0#5059
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/gradle/ktor-3.6.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 24, 2026

Copy link
Copy Markdown
Contributor

Bumps ktor from 3.5.2 to 3.6.0.
Updates io.ktor:ktor-client-content-negotiation from 3.5.2 to 3.6.0

Release notes

Sourced from io.ktor:ktor-client-content-negotiation's releases.

3.6.0

Published 16 September 2026

Features

  • KTOR-8596 OpenID Connect (OAuth2) auto-discover & configuration
  • KTOR-9645 Client curated multi-platform facade module
  • KTOR-8883 Support nested jars in static resources
  • KTOR-8672 Support at least zstd and deflate formats of precompressed files
  • KTOR-8595 Auth JWK Support (auto-discover)
  • KTOR-9841 OIDC Server Plugin
  • KTOR-9654 Override fetch in JS engine
  • KTOR-9785 Typesafe Authentication DSL
  • KTOR-462 Async CIO DNS resolver with timeout
  • KTOR-9709 Add resource attribute for client resources plugin
  • KTOR-5009 ContentNegotiation: Add a way to prevent changing Accept and Content-Type headers
  • KTOR-9776 OpenAPI: Support the "const" validation keyword
  • KTOR-7468 DefaultConversionService: Support Uuid type introduced in Kotlin 2.0
  • KTOR-9578 HttpCache add method for clearing
  • KTOR-9590 OpenAPI Contextual JSON schema inference support
  • KTOR-6610 Log which ConfigLoader has been used for loading the server configuration
  • KTOR-9735 Commonize HttpCache FileCacheStorage
  • KTOR-8953 WebRTC client on JVM
  • KTOR-9674 UDP support for Node.js targets
  • KTOR-9612 Add text/markdown to the ContentType constants

Improvements

  • KTOR-9876 Typo in KDoc for routing function: "for the this Application".
  • KTOR-9778 Character classification in ktor-http hot paths uses boxed Set lookups and per-symbol encoder allocations
  • KTOR-9702 Duplicate code in ByteReadChannel
  • KTOR-9716 Make ApplicationCallPipeline.ApplicationPhase.Validators public in 3.6.0
  • KTOR-9734 Use TagConsumer in respondHtmlFragment lambda receiver
  • KTOR-5577 Support nullable types in ApplicationCall.receive
  • KTOR-2367 OAuth: clients expect to get authenticated once per "session" for all protected routes
  • KTOR-8594 Auth: Non-optional principal is of nullable type
  • KTOR-9816 Escape $ in application.yaml file
  • KTOR-8193 Unnecessary blocking in OutputStream wrapper

Bugfixes

  • KTOR-8705 testApplication: call coroutine context isn't preserved when responding with ChannelWriterContent
  • KTOR-9248 JWTAuthenticationProvider silently swallows exceptions
  • KTOR-9892 Digest Auth client: nc and qop are not handled according to RFC 7616
  • KTOR-9891 CIO on Kotlin/Native collapses above ~50 connections: HttpHeadersMap pools contend on an allocating SynchronizedObject
  • KTOR-9794 Digest Auth: NullPointerException when the server does not expect Digest auth
  • KTOR-9788 Netty: engine double-responds after its built-in 400, crashing the call-handler coroutine with "Headers can no longer be set because response was already completed"
  • KTOR-9834 HttpClient eagerly initializes SLF4J during Android startup
  • KTOR-9701 Jackson/Gson converters waste time on unnecessary Dispatchers.IO dispatch
  • KTOR-9832 Apache5: Upgrading Apache HttpClient5 to version 5.6 breaks the Ktor client with Content-Length mismatch error for any gzipped content
  • KTOR-9870 OkHttp: Reduce coroutine dispatching and allocations while reading response bodies
  • KTOR-9627 Cancel blocking bridges when coroutine is cancelled
  • KTOR-7067 Ktor Cookie.parseClientCookiesHeader returns Map, which breaks Cookie header contract

... (truncated)

Changelog

Sourced from io.ktor:ktor-client-content-negotiation's changelog.

3.6.0

Published 16 September 2026

Features

  • KTOR-8596 OpenID Connect (OAuth2) auto-discover & configuration
  • KTOR-9645 Client curated multi-platform facade module
  • KTOR-8883 Support nested jars in static resources
  • KTOR-8672 Support at least zstd and deflate formats of precompressed files
  • KTOR-8595 Auth JWK Support (auto-discover)
  • KTOR-9841 OIDC Server Plugin
  • KTOR-9654 Override fetch in JS engine
  • KTOR-9785 Typesafe Authentication DSL
  • KTOR-462 Async CIO DNS resolver with timeout
  • KTOR-9709 Add resource attribute for client resources plugin
  • KTOR-5009 ContentNegotiation: Add a way to prevent changing Accept and Content-Type headers
  • KTOR-9776 OpenAPI: Support the "const" validation keyword
  • KTOR-7468 DefaultConversionService: Support Uuid type introduced in Kotlin 2.0
  • KTOR-9578 HttpCache add method for clearing
  • KTOR-9590 OpenAPI Contextual JSON schema inference support
  • KTOR-6610 Log which ConfigLoader has been used for loading the server configuration
  • KTOR-9735 Commonize HttpCache FileCacheStorage
  • KTOR-8953 WebRTC client on JVM
  • KTOR-9674 UDP support for Node.js targets
  • KTOR-9612 Add text/markdown to the ContentType constants

Improvements

  • KTOR-9876 Typo in KDoc for routing function: "for the this Application".
  • KTOR-9778 Character classification in ktor-http hot paths uses boxed Set lookups and per-symbol encoder allocations
  • KTOR-9702 Duplicate code in ByteReadChannel
  • KTOR-9716 Make ApplicationCallPipeline.ApplicationPhase.Validators public in 3.6.0
  • KTOR-9734 Use TagConsumer in respondHtmlFragment lambda receiver
  • KTOR-5577 Support nullable types in ApplicationCall.receive
  • KTOR-2367 OAuth: clients expect to get authenticated once per "session" for all protected routes
  • KTOR-8594 Auth: Non-optional principal is of nullable type
  • KTOR-9816 Escape $ in application.yaml file
  • KTOR-8193 Unnecessary blocking in OutputStream wrapper

Bugfixes

  • KTOR-8705 testApplication: call coroutine context isn't preserved when responding with ChannelWriterContent
  • KTOR-9248 JWTAuthenticationProvider silently swallows exceptions
  • KTOR-9892 Digest Auth client: nc and qop are not handled according to RFC 7616
  • KTOR-9891 CIO on Kotlin/Native collapses above ~50 connections: HttpHeadersMap pools contend on an allocating SynchronizedObject
  • KTOR-9794 Digest Auth: NullPointerException when the server does not expect Digest auth
  • KTOR-9788 Netty: engine double-responds after its built-in 400, crashing the call-handler coroutine with "Headers can no longer be set because response was already completed"
  • KTOR-9834 HttpClient eagerly initializes SLF4J during Android startup
  • KTOR-9701 Jackson/Gson converters waste time on unnecessary Dispatchers.IO dispatch
  • KTOR-9832 Apache5: Upgrading Apache HttpClient5 to version 5.6 breaks the Ktor client with Content-Length mismatch error for any gzipped content
  • KTOR-9870 OkHttp: Reduce coroutine dispatching and allocations while reading response bodies
  • KTOR-9627 Cancel blocking bridges when coroutine is cancelled
  • KTOR-7067 Ktor Cookie.parseClientCookiesHeader returns Map, which breaks Cookie header contract

... (truncated)

Commits
  • 111c580 Release 3.6.0 (#5882)
  • 1e4186c KTOR-9876 Fix typo in Application.routing KDoc (#5876)
  • 6930eee Fix KTOR-9892 Digest Auth client: nc and qop ... (#5875)
  • 875b2f0 Fix KTOR-9794 Digest Auth: NullPointerException when the server does not expe...
  • dc56137 KTOR-8705 Pass coroutine context to the channel writer (#5868)
  • 55f6e71 Fix KTOR-9640 forward autoFlush in reader/writer helpers
  • 2b04a1f Fix KTOR-9248 JWTAuthenticationProvider silently swallows exceptions (#5877)
  • 702ff9f KTOR-9889 Fix deadlock in concurrent module loading with Dependency Injection...
  • 1fab5f1 Reject Accept entries with q=0 in ContentNegotiation (#5873)
  • b06c3b5 KTOR-9891 Delegate SynchronizedObject to kotlinx.atomicfu on Native (#5874)
  • Additional commits viewable in compare view

Updates io.ktor:ktor-client-core from 3.5.2 to 3.6.0

Release notes

Sourced from io.ktor:ktor-client-core's releases.

3.6.0

Published 16 September 2026

Features

  • KTOR-8596 OpenID Connect (OAuth2) auto-discover & configuration
  • KTOR-9645 Client curated multi-platform facade module
  • KTOR-8883 Support nested jars in static resources
  • KTOR-8672 Support at least zstd and deflate formats of precompressed files
  • KTOR-8595 Auth JWK Support (auto-discover)
  • KTOR-9841 OIDC Server Plugin
  • KTOR-9654 Override fetch in JS engine
  • KTOR-9785 Typesafe Authentication DSL
  • KTOR-462 Async CIO DNS resolver with timeout
  • KTOR-9709 Add resource attribute for client resources plugin
  • KTOR-5009 ContentNegotiation: Add a way to prevent changing Accept and Content-Type headers
  • KTOR-9776 OpenAPI: Support the "const" validation keyword
  • KTOR-7468 DefaultConversionService: Support Uuid type introduced in Kotlin 2.0
  • KTOR-9578 HttpCache add method for clearing
  • KTOR-9590 OpenAPI Contextual JSON schema inference support
  • KTOR-6610 Log which ConfigLoader has been used for loading the server configuration
  • KTOR-9735 Commonize HttpCache FileCacheStorage
  • KTOR-8953 WebRTC client on JVM
  • KTOR-9674 UDP support for Node.js targets
  • KTOR-9612 Add text/markdown to the ContentType constants

Improvements

  • KTOR-9876 Typo in KDoc for routing function: "for the this Application".
  • KTOR-9778 Character classification in ktor-http hot paths uses boxed Set lookups and per-symbol encoder allocations
  • KTOR-9702 Duplicate code in ByteReadChannel
  • KTOR-9716 Make ApplicationCallPipeline.ApplicationPhase.Validators public in 3.6.0
  • KTOR-9734 Use TagConsumer in respondHtmlFragment lambda receiver
  • KTOR-5577 Support nullable types in ApplicationCall.receive
  • KTOR-2367 OAuth: clients expect to get authenticated once per "session" for all protected routes
  • KTOR-8594 Auth: Non-optional principal is of nullable type
  • KTOR-9816 Escape $ in application.yaml file
  • KTOR-8193 Unnecessary blocking in OutputStream wrapper

Bugfixes

  • KTOR-8705 testApplication: call coroutine context isn't preserved when responding with ChannelWriterContent
  • KTOR-9248 JWTAuthenticationProvider silently swallows exceptions
  • KTOR-9892 Digest Auth client: nc and qop are not handled according to RFC 7616
  • KTOR-9891 CIO on Kotlin/Native collapses above ~50 connections: HttpHeadersMap pools contend on an allocating SynchronizedObject
  • KTOR-9794 Digest Auth: NullPointerException when the server does not expect Digest auth
  • KTOR-9788 Netty: engine double-responds after its built-in 400, crashing the call-handler coroutine with "Headers can no longer be set because response was already completed"
  • KTOR-9834 HttpClient eagerly initializes SLF4J during Android startup
  • KTOR-9701 Jackson/Gson converters waste time on unnecessary Dispatchers.IO dispatch
  • KTOR-9832 Apache5: Upgrading Apache HttpClient5 to version 5.6 breaks the Ktor client with Content-Length mismatch error for any gzipped content
  • KTOR-9870 OkHttp: Reduce coroutine dispatching and allocations while reading response bodies
  • KTOR-9627 Cancel blocking bridges when coroutine is cancelled
  • KTOR-7067 Ktor Cookie.parseClientCookiesHeader returns Map, which breaks Cookie header contract

... (truncated)

Changelog

Sourced from io.ktor:ktor-client-core's changelog.

3.6.0

Published 16 September 2026

Features

  • KTOR-8596 OpenID Connect (OAuth2) auto-discover & configuration
  • KTOR-9645 Client curated multi-platform facade module
  • KTOR-8883 Support nested jars in static resources
  • KTOR-8672 Support at least zstd and deflate formats of precompressed files
  • KTOR-8595 Auth JWK Support (auto-discover)
  • KTOR-9841 OIDC Server Plugin
  • KTOR-9654 Override fetch in JS engine
  • KTOR-9785 Typesafe Authentication DSL
  • KTOR-462 Async CIO DNS resolver with timeout
  • KTOR-9709 Add resource attribute for client resources plugin
  • KTOR-5009 ContentNegotiation: Add a way to prevent changing Accept and Content-Type headers
  • KTOR-9776 OpenAPI: Support the "const" validation keyword
  • KTOR-7468 DefaultConversionService: Support Uuid type introduced in Kotlin 2.0
  • KTOR-9578 HttpCache add method for clearing
  • KTOR-9590 OpenAPI Contextual JSON schema inference support
  • KTOR-6610 Log which ConfigLoader has been used for loading the server configuration
  • KTOR-9735 Commonize HttpCache FileCacheStorage
  • KTOR-8953 WebRTC client on JVM
  • KTOR-9674 UDP support for Node.js targets
  • KTOR-9612 Add text/markdown to the ContentType constants

Improvements

  • KTOR-9876 Typo in KDoc for routing function: "for the this Application".
  • KTOR-9778 Character classification in ktor-http hot paths uses boxed Set lookups and per-symbol encoder allocations
  • KTOR-9702 Duplicate code in ByteReadChannel
  • KTOR-9716 Make ApplicationCallPipeline.ApplicationPhase.Validators public in 3.6.0
  • KTOR-9734 Use TagConsumer in respondHtmlFragment lambda receiver
  • KTOR-5577 Support nullable types in ApplicationCall.receive
  • KTOR-2367 OAuth: clients expect to get authenticated once per "session" for all protected routes
  • KTOR-8594 Auth: Non-optional principal is of nullable type
  • KTOR-9816 Escape $ in application.yaml file
  • KTOR-8193 Unnecessary blocking in OutputStream wrapper

Bugfixes

  • KTOR-8705 testApplication: call coroutine context isn't preserved when responding with ChannelWriterContent
  • KTOR-9248 JWTAuthenticationProvider silently swallows exceptions
  • KTOR-9892 Digest Auth client: nc and qop are not handled according to RFC 7616
  • KTOR-9891 CIO on Kotlin/Native collapses above ~50 connections: HttpHeadersMap pools contend on an allocating SynchronizedObject
  • KTOR-9794 Digest Auth: NullPointerException when the server does not expect Digest auth
  • KTOR-9788 Netty: engine double-responds after its built-in 400, crashing the call-handler coroutine with "Headers can no longer be set because response was already completed"
  • KTOR-9834 HttpClient eagerly initializes SLF4J during Android startup
  • KTOR-9701 Jackson/Gson converters waste time on unnecessary Dispatchers.IO dispatch
  • KTOR-9832 Apache5: Upgrading Apache HttpClient5 to version 5.6 breaks the Ktor client with Content-Length mismatch error for any gzipped content
  • KTOR-9870 OkHttp: Reduce coroutine dispatching and allocations while reading response bodies
  • KTOR-9627 Cancel blocking bridges when coroutine is cancelled
  • KTOR-7067 Ktor Cookie.parseClientCookiesHeader returns Map, which breaks Cookie header contract

... (truncated)

Commits
  • 111c580 Release 3.6.0 (#5882)
  • 1e4186c KTOR-9876 Fix typo in Application.routing KDoc (#5876)
  • 6930eee Fix KTOR-9892 Digest Auth client: nc and qop ... (#5875)
  • 875b2f0 Fix KTOR-9794 Digest Auth: NullPointerException when the server does not expe...
  • dc56137 KTOR-8705 Pass coroutine context to the channel writer (#5868)
  • 55f6e71 Fix KTOR-9640 forward autoFlush in reader/writer helpers
  • 2b04a1f Fix KTOR-9248 JWTAuthenticationProvider silently swallows exceptions (#5877)
  • 702ff9f KTOR-9889 Fix deadlock in concurrent module loading with Dependency Injection...
  • 1fab5f1 Reject Accept entries with q=0 in ContentNegotiation (#5873)
  • b06c3b5 KTOR-9891 Delegate SynchronizedObject to kotlinx.atomicfu on Native (#5874)
  • Additional commits viewable in compare view

Updates io.ktor:ktor-client-cio from 3.5.2 to 3.6.0

Release notes

Sourced from io.ktor:ktor-client-cio's releases.

3.6.0

Published 16 September 2026

Features

  • KTOR-8596 OpenID Connect (OAuth2) auto-discover & configuration
  • KTOR-9645 Client curated multi-platform facade module
  • KTOR-8883 Support nested jars in static resources
  • KTOR-8672 Support at least zstd and deflate formats of precompressed files
  • KTOR-8595 Auth JWK Support (auto-discover)
  • KTOR-9841 OIDC Server Plugin
  • KTOR-9654 Override fetch in JS engine
  • KTOR-9785 Typesafe Authentication DSL
  • KTOR-462 Async CIO DNS resolver with timeout
  • KTOR-9709 Add resource attribute for client resources plugin
  • KTOR-5009 ContentNegotiation: Add a way to prevent changing Accept and Content-Type headers
  • KTOR-9776 OpenAPI: Support the "const" validation keyword
  • KTOR-7468 DefaultConversionService: Support Uuid type introduced in Kotlin 2.0
  • KTOR-9578 HttpCache add method for clearing
  • KTOR-9590 OpenAPI Contextual JSON schema inference support
  • KTOR-6610 Log which ConfigLoader has been used for loading the server configuration
  • KTOR-9735 Commonize HttpCache FileCacheStorage
  • KTOR-8953 WebRTC client on JVM
  • KTOR-9674 UDP support for Node.js targets
  • KTOR-9612 Add text/markdown to the ContentType constants

Improvements

  • KTOR-9876 Typo in KDoc for routing function: "for the this Application".
  • KTOR-9778 Character classification in ktor-http hot paths uses boxed Set lookups and per-symbol encoder allocations
  • KTOR-9702 Duplicate code in ByteReadChannel
  • KTOR-9716 Make ApplicationCallPipeline.ApplicationPhase.Validators public in 3.6.0
  • KTOR-9734 Use TagConsumer in respondHtmlFragment lambda receiver
  • KTOR-5577 Support nullable types in ApplicationCall.receive
  • KTOR-2367 OAuth: clients expect to get authenticated once per "session" for all protected routes
  • KTOR-8594 Auth: Non-optional principal is of nullable type
  • KTOR-9816 Escape $ in application.yaml file
  • KTOR-8193 Unnecessary blocking in OutputStream wrapper

Bugfixes

  • KTOR-8705 testApplication: call coroutine context isn't preserved when responding with ChannelWriterContent
  • KTOR-9248 JWTAuthenticationProvider silently swallows exceptions
  • KTOR-9892 Digest Auth client: nc and qop are not handled according to RFC 7616
  • KTOR-9891 CIO on Kotlin/Native collapses above ~50 connections: HttpHeadersMap pools contend on an allocating SynchronizedObject
  • KTOR-9794 Digest Auth: NullPointerException when the server does not expect Digest auth
  • KTOR-9788 Netty: engine double-responds after its built-in 400, crashing the call-handler coroutine with "Headers can no longer be set because response was already completed"
  • KTOR-9834 HttpClient eagerly initializes SLF4J during Android startup
  • KTOR-9701 Jackson/Gson converters waste time on unnecessary Dispatchers.IO dispatch
  • KTOR-9832 Apache5: Upgrading Apache HttpClient5 to version 5.6 breaks the Ktor client with Content-Length mismatch error for any gzipped content
  • KTOR-9870 OkHttp: Reduce coroutine dispatching and allocations while reading response bodies
  • KTOR-9627 Cancel blocking bridges when coroutine is cancelled
  • KTOR-7067 Ktor Cookie.parseClientCookiesHeader returns Map, which breaks Cookie header contract

... (truncated)

Changelog

Sourced from io.ktor:ktor-client-cio's changelog.

3.6.0

Published 16 September 2026

Features

  • KTOR-8596 OpenID Connect (OAuth2) auto-discover & configuration
  • KTOR-9645 Client curated multi-platform facade module
  • KTOR-8883 Support nested jars in static resources
  • KTOR-8672 Support at least zstd and deflate formats of precompressed files
  • KTOR-8595 Auth JWK Support (auto-discover)
  • KTOR-9841 OIDC Server Plugin
  • KTOR-9654 Override fetch in JS engine
  • KTOR-9785 Typesafe Authentication DSL
  • KTOR-462 Async CIO DNS resolver with timeout
  • KTOR-9709 Add resource attribute for client resources plugin
  • KTOR-5009 ContentNegotiation: Add a way to prevent changing Accept and Content-Type headers
  • KTOR-9776 OpenAPI: Support the "const" validation keyword
  • KTOR-7468 DefaultConversionService: Support Uuid type introduced in Kotlin 2.0
  • KTOR-9578 HttpCache add method for clearing
  • KTOR-9590 OpenAPI Contextual JSON schema inference support
  • KTOR-6610 Log which ConfigLoader has been used for loading the server configuration
  • KTOR-9735 Commonize HttpCache FileCacheStorage
  • KTOR-8953 WebRTC client on JVM
  • KTOR-9674 UDP support for Node.js targets
  • KTOR-9612 Add text/markdown to the ContentType constants

Improvements

  • KTOR-9876 Typo in KDoc for routing function: "for the this Application".
  • KTOR-9778 Character classification in ktor-http hot paths uses boxed Set lookups and per-symbol encoder allocations
  • KTOR-9702 Duplicate code in ByteReadChannel
  • KTOR-9716 Make ApplicationCallPipeline.ApplicationPhase.Validators public in 3.6.0
  • KTOR-9734 Use TagConsumer in respondHtmlFragment lambda receiver
  • KTOR-5577 Support nullable types in ApplicationCall.receive
  • KTOR-2367 OAuth: clients expect to get authenticated once per "session" for all protected routes
  • KTOR-8594 Auth: Non-optional principal is of nullable type
  • KTOR-9816 Escape $ in application.yaml file
  • KTOR-8193 Unnecessary blocking in OutputStream wrapper

Bugfixes

  • KTOR-8705 testApplication: call coroutine context isn't preserved when responding with ChannelWriterContent
  • KTOR-9248 JWTAuthenticationProvider silently swallows exceptions
  • KTOR-9892 Digest Auth client: nc and qop are not handled according to RFC 7616
  • KTOR-9891 CIO on Kotlin/Native collapses above ~50 connections: HttpHeadersMap pools contend on an allocating SynchronizedObject
  • KTOR-9794 Digest Auth: NullPointerException when the server does not expect Digest auth
  • KTOR-9788 Netty: engine double-responds after its built-in 400, crashing the call-handler coroutine with "Headers can no longer be set because response was already completed"
  • KTOR-9834 HttpClient eagerly initializes SLF4J during Android startup
  • KTOR-9701 Jackson/Gson converters waste time on unnecessary Dispatchers.IO dispatch
  • KTOR-9832 Apache5: Upgrading Apache HttpClient5 to version 5.6 breaks the Ktor client with Content-Length mismatch error for any gzipped content
  • KTOR-9870 OkHttp: Reduce coroutine dispatching and allocations while reading response bodies
  • KTOR-9627 Cancel blocking bridges when coroutine is cancelled
  • KTOR-7067 Ktor Cookie.parseClientCookiesHeader returns Map, which breaks Cookie header contract

... (truncated)

Commits
  • 111c580 Release 3.6.0 (#5882)
  • 1e4186c KTOR-9876 Fix typo in Application.routing KDoc (#5876)
  • 6930eee Fix KTOR-9892 Digest Auth client: nc and qop ... (#5875)
  • 875b2f0 Fix KTOR-9794 Digest Auth: NullPointerException when the server does not expe...
  • dc56137 KTOR-8705 Pass coroutine context to the channel writer (#5868)
  • 55f6e71 Fix KTOR-9640 forward autoFlush in reader/writer helpers
  • 2b04a1f Fix KTOR-9248 JWTAuthenticationProvider silently swallows exceptions (#5877)
  • 702ff9f KTOR-9889 Fix deadlock in concurrent module loading with Dependency Injection...
  • 1fab5f1 Reject Accept entries with q=0 in ContentNegotiation (#5873)
  • b06c3b5 KTOR-9891 Delegate SynchronizedObject to kotlinx.atomicfu on Native (#5874)
  • Additional commits viewable in compare view

Updates io.ktor:ktor-client-logging from 3.5.2 to 3.6.0

Release notes

Sourced from io.ktor:ktor-client-logging's releases.

3.6.0

Published 16 September 2026

Features

  • KTOR-8596 OpenID Connect (OAuth2) auto-discover & configuration
  • KTOR-9645 Client curated multi-platform facade module
  • KTOR-8883 Support nested jars in static resources
  • KTOR-8672 Support at least zstd and deflate formats of precompressed files
  • KTOR-8595 Auth JWK Support (auto-discover)
  • KTOR-9841 OIDC Server Plugin
  • KTOR-9654 Override fetch in JS engine
  • KTOR-9785 Typesafe Authentication DSL
  • KTOR-462 Async CIO DNS resolver with timeout
  • KTOR-9709 Add resource attribute for client resources plugin
  • KTOR-5009 ContentNegotiation: Add a way to prevent changing Accept and Content-Type headers
  • KTOR-9776 OpenAPI: Support the "const" validation keyword
  • KTOR-7468 DefaultConversionService: Support Uuid type introduced in Kotlin 2.0
  • KTOR-9578 HttpCache add method for clearing
  • KTOR-9590 OpenAPI Contextual JSON schema inference support
  • KTOR-6610 Log which ConfigLoader has been used for loading the server configuration
  • KTOR-9735 Commonize HttpCache FileCacheStorage
  • KTOR-8953 WebRTC client on JVM
  • KTOR-9674 UDP support for Node.js targets
  • KTOR-9612 Add text/markdown to the ContentType constants

Improvements

  • KTOR-9876 Typo in KDoc for routing function: "for the this Application".
  • KTOR-9778 Character classification in ktor-http hot paths uses boxed Set lookups and per-symbol encoder allocations
  • KTOR-9702 Duplicate code in ByteReadChannel
  • KTOR-9716 Make ApplicationCallPipeline.ApplicationPhase.Validators public in 3.6.0
  • KTOR-9734 Use TagConsumer in respondHtmlFragment lambda receiver
  • KTOR-5577 Support nullable types in ApplicationCall.receive
  • KTOR-2367 OAuth: clients expect to get authenticated once per "session" for all protected routes
  • KTOR-8594 Auth: Non-optional principal is of nullable type
  • KTOR-9816 Escape $ in application.yaml file
  • KTOR-8193 Unnecessary blocking in OutputStream wrapper

Bugfixes

  • KTOR-8705 testApplication: call coroutine context isn't preserved when responding with ChannelWriterContent
  • KTOR-9248 JWTAuthenticationProvider silently swallows exceptions
  • KTOR-9892 Digest Auth client: nc and qop are not handled according to RFC 7616
  • KTOR-9891 CIO on Kotlin/Native collapses above ~50 connections: HttpHeadersMap pools contend on an allocating SynchronizedObject
  • KTOR-9794 Digest Auth: NullPointerException when the server does not expect Digest auth
  • KTOR-9788 Netty: engine double-responds after its built-in 400, crashing the call-handler coroutine with "Headers can no longer be set because response was already completed"
  • KTOR-9834 HttpClient eagerly initializes SLF4J during Android startup
  • KTOR-9701 Jackson/Gson converters waste time on unnecessary Dispatchers.IO dispatch
  • KTOR-9832 Apache5: Upgrading Apache HttpClient5 to version 5.6 breaks the Ktor client with Content-Length mismatch error for any gzipped content
  • KTOR-9870 OkHttp: Reduce coroutine dispatching and allocations while reading response bodies
  • KTOR-9627 Cancel blocking bridges when coroutine is cancelled
  • KTOR-7067 Ktor Cookie.parseClientCookiesHeader returns Map, which breaks Cookie header contract

... (truncated)

Changelog

Sourced from io.ktor:ktor-client-logging's changelog.

3.6.0

Published 16 September 2026

Features

  • KTOR-8596 OpenID Connect (OAuth2) auto-discover & configuration
  • KTOR-9645 Client curated multi-platform facade module
  • KTOR-8883 Support nested jars in static resources
  • KTOR-8672 Support at least zstd and deflate formats of precompressed files
  • KTOR-8595 Auth JWK Support (auto-discover)
  • KTOR-9841 OIDC Server Plugin
  • KTOR-9654 Override fetch in JS engine
  • KTOR-9785 Typesafe Authentication DSL
  • KTOR-462 Async CIO DNS resolver with timeout
  • KTOR-9709 Add resource attribute for client resources plugin
  • KTOR-5009 ContentNegotiation: Add a way to prevent changing Accept and Content-Type headers
  • KTOR-9776 OpenAPI: Support the "const" validation keyword
  • KTOR-7468 DefaultConversionService: Support Uuid type introduced in Kotlin 2.0
  • KTOR-9578 HttpCache add method for clearing
  • KTOR-9590 OpenAPI Contextual JSON schema inference support
  • KTOR-6610 Log which ConfigLoader has been used for loading the server configuration
  • KTOR-9735 Commonize HttpCache FileCacheStorage
  • KTOR-8953 WebRTC client on JVM
  • KTOR-9674 UDP support for Node.js targets
  • KTOR-9612 Add text/markdown to the ContentType constants

Improvements

  • KTOR-9876 Typo in KDoc for routing function: "for the this Application".
  • KTOR-9778 Character classification in ktor-http hot paths uses boxed Set lookups and per-symbol encoder allocations
  • KTOR-9702 Duplicate code in ByteReadChannel
  • KTOR-9716 Make ApplicationCallPipeline.ApplicationPhase.Validators public in 3.6.0
  • KTOR-9734 Use TagConsumer in respondHtmlFragment lambda receiver
  • KTOR-5577 Support nullable types in ApplicationCall.receive
  • KTOR-2367 OAuth: clients expect to get authenticated once per "session" for all protected routes
  • KTOR-8594 Auth: Non-optional principal is of nullable type
  • KTOR-9816 Escape $ in application.yaml file
  • KTOR-8193 Unnecessary blocking in OutputStream wrapper

Bugfixes

  • KTOR-8705 testApplication: call coroutine context isn't preserved when responding with ChannelWriterContent
  • KTOR-9248 JWTAuthenticationProvider silently swallows exceptions
  • KTOR-9892 Digest Auth client: nc and qop are not handled according to RFC 7616
  • KTOR-9891 CIO on Kotlin/Native collapses above ~50 connections: HttpHeadersMap pools contend on an allocating SynchronizedObject
  • KTOR-9794 Digest Auth: NullPointerException when the server does not expect Digest auth
  • KTOR-9788 Netty: engine double-responds after its built-in 400, crashing the call-handler coroutine with "Headers can no longer be set because response was already completed"
  • KTOR-9834 HttpClient eagerly initializes SLF4J during Android startup
  • KTOR-9701 Jackson/Gson converters waste time on unnecessary Dispatchers.IO dispatch
  • KTOR-9832 Apache5: Upgrading Apache HttpClient5 to version 5.6 breaks the Ktor client with Content-Length mismatch error for any gzipped content
  • KTOR-9870 OkHttp: Reduce coroutine dispatching and allocations while reading response bodies
  • KTOR-9627 Cancel blocking bridges when coroutine is cancelled
  • KTOR-7067 Ktor Cookie.parseClientCookiesHeader returns Map, which breaks Cookie header contract

... (truncated)

Commits
  • 111c580 Release 3.6.0 (#5882)
  • 1e4186c KTOR-9876 Fix typo in Application.routing KDoc (#5876)
  • 6930eee Fix KTOR-9892 Digest Auth client: nc and qop ... (#5875)
  • 875b2f0 Fix KTOR-9794 Digest Auth: NullPointerException when the server does not expe...
  • dc56137 KTOR-8705 Pass coroutine context to the channel writer (#5868)
  • 55f6e71 Fix KTOR-9640 forward autoFlush in reader/writer helpers
  • 2b04a1f Fix KTOR-9248 JWTAuthenticationProvider silently swallows exceptions (#5877)
  • 702ff9f KTOR-9889 Fix deadlock in concurrent module loading with Dependency Injection...
  • 1fab5f1 Reject Accept entries with q=0 in ContentNegotiation (#5873)
  • b06c3b5 KTOR-9891 Delegate SynchronizedObject to kotlinx.atomicfu on Native (#5874)
  • Additional commits viewable in compare view

Updates io.ktor:ktor-client-mock from 3.5.2 to 3.6.0

Release notes

Sourced from io.ktor:ktor-client-mock's releases.

3.6.0

Published 16 September 2026

Features

  • KTOR-8596 OpenID Connect (OAuth2) auto-discover & configuration
  • KTOR-9645 Client curated multi-platform facade module
  • KTOR-8883 Support nested jars in static resources
  • KTOR-8672 Support at least zstd and deflate formats of precompressed files
  • KTOR-8595 Auth JWK Support (auto-discover)
  • KTOR-9841 OIDC Server Plugin
  • KTOR-9654 Override fetch in JS engine
  • KTOR-9785 Typesafe Authentication DSL
  • KTOR-462 Async CIO DNS resolver with timeout
  • KTOR-9709 Add resource attribute for client resources plugin
  • KTOR-5009 ContentNegotiation: Add a way to prevent changing Accept and Content-Type headers
  • KTOR-9776 OpenAPI: Support the "const" validation keyword
  • KTOR-7468 DefaultConversionService: Support Uuid type introduced in Kotlin 2.0
  • KTOR-9578 HttpCache add method for clearing
  • KTOR-9590 OpenAPI Contextual JSON schema inference support
  • KTOR-6610 Log which ConfigLoader has been used for loading the server configuration
  • KTOR-9735 Commonize HttpCache FileCacheStorage
  • KTOR-8953 WebRTC client on JVM
  • KTOR-9674 UDP support for Node.js targets
  • KTOR-9612 Add text/markdown to the ContentType constants

Improvements

  • KTOR-9876 Typo in KDoc for routing function: "for the this Application".
  • KTOR-9778 Character classification in ktor-http hot paths uses boxed Set lookups and per-symbol encoder allocations
  • KTOR-9702 Duplicate code in ByteRead...

    Description has been truncated

@dependabot
⬆️ Bump ktor from 3.5.2 to 3.6.0
abea0d4 
Bumps `ktor` from 3.5.2 to 3.6.0.

Updates `io.ktor:ktor-client-content-negotiation` from 3.5.2 to 3.6.0
- [Release notes](https://github.com/ktorio/ktor/releases)
- [Changelog](https://github.com/ktorio/ktor/blob/main/CHANGELOG.md)
- [Commits](ktorio/ktor@3.5.2...3.6.0)

Updates `io.ktor:ktor-client-core` from 3.5.2 to 3.6.0
- [Release notes](https://github.com/ktorio/ktor/releases)
- [Changelog](https://github.com/ktorio/ktor/blob/main/CHANGELOG.md)
- [Commits](ktorio/ktor@3.5.2...3.6.0)

Updates `io.ktor:ktor-client-cio` from 3.5.2 to 3.6.0
- [Release notes](https://github.com/ktorio/ktor/releases)
- [Changelog](https://github.com/ktorio/ktor/blob/main/CHANGELOG.md)
- [Commits](ktorio/ktor@3.5.2...3.6.0)

Updates `io.ktor:ktor-client-logging` from 3.5.2 to 3.6.0
- [Release notes](https://github.com/ktorio/ktor/releases)
- [Changelog](https://github.com/ktorio/ktor/blob/main/CHANGELOG.md)
- [Commits](ktorio/ktor@3.5.2...3.6.0)

Updates `io.ktor:ktor-client-mock` from 3.5.2 to 3.6.0
- [Release notes](https://github.com/ktorio/ktor/releases)
- [Changelog](https://github.com/ktorio/ktor/blob/main/CHANGELOG.md)
- [Commits](ktorio/ktor@3.5.2...3.6.0)

Updates `io.ktor:ktor-client-okhttp` from 3.5.2 to 3.6.0
- [Release notes](https://github.com/ktorio/ktor/releases)
- [Changelog](https://github.com/ktorio/ktor/blob/main/CHANGELOG.md)
- [Commits](ktorio/ktor@3.5.2...3.6.0)

Updates `io.ktor:ktor-client-websockets` from 3.5.2 to 3.6.0
- [Release notes](https://github.com/ktorio/ktor/releases)
- [Changelog](https://github.com/ktorio/ktor/blob/main/CHANGELOG.md)
- [Commits](ktorio/ktor@3.5.2...3.6.0)

Updates `io.ktor:ktor-io` from 3.5.2 to 3.6.0
- [Release notes](https://github.com/ktorio/ktor/releases)
- [Changelog](https://github.com/ktorio/ktor/blob/main/CHANGELOG.md)
- [Commits](ktorio/ktor@3.5.2...3.6.0)

Updates `io.ktor:ktor-network` from 3.5.2 to 3.6.0
- [Release notes](https://github.com/ktorio/ktor/releases)
- [Changelog](https://github.com/ktorio/ktor/blob/main/CHANGELOG.md)
- [Commits](ktorio/ktor@3.5.2...3.6.0)

Updates `io.ktor:ktor-serialization-kotlinx-json` from 3.5.2 to 3.6.0
- [Release notes](https://github.com/ktorio/ktor/releases)
- [Changelog](https://github.com/ktorio/ktor/blob/main/CHANGELOG.md)
- [Commits](ktorio/ktor@3.5.2...3.6.0)

Updates `io.ktor:ktor-server-cio` from 3.5.2 to 3.6.0
- [Release notes](https://github.com/ktorio/ktor/releases)
- [Changelog](https://github.com/ktorio/ktor/blob/main/CHANGELOG.md)
- [Commits](ktorio/ktor@3.5.2...3.6.0)

Updates `io.ktor:ktor-server-compression` from 3.5.2 to 3.6.0
- [Release notes](https://github.com/ktorio/ktor/releases)
- [Changelog](https://github.com/ktorio/ktor/blob/main/CHANGELOG.md)
- [Commits](ktorio/ktor@3.5.2...3.6.0)

Updates `io.ktor:ktor-server-content-negotiation` from 3.5.2 to 3.6.0
- [Release notes](https://github.com/ktorio/ktor/releases)
- [Changelog](https://github.com/ktorio/ktor/blob/main/CHANGELOG.md)
- [Commits](ktorio/ktor@3.5.2...3.6.0)

Updates `io.ktor:ktor-server-core` from 3.5.2 to 3.6.0
- [Release notes](https://github.com/ktorio/ktor/releases)
- [Changelog](https://github.com/ktorio/ktor/blob/main/CHANGELOG.md)
- [Commits](ktorio/ktor@3.5.2...3.6.0)

Updates `io.ktor:ktor-server-status-pages` from 3.5.2 to 3.6.0
- [Release notes](https://github.com/ktorio/ktor/releases)
- [Changelog](https://github.com/ktorio/ktor/blob/main/CHANGELOG.md)
- [Commits](ktorio/ktor@3.5.2...3.6.0)

Updates `io.ktor:ktor-server-test-host` from 3.5.2 to 3.6.0
- [Release notes](https://github.com/ktorio/ktor/releases)
- [Changelog](https://github.com/ktorio/ktor/blob/main/CHANGELOG.md)
- [Commits](ktorio/ktor@3.5.2...3.6.0)

Updates `io.ktor:ktor-server-websockets` from 3.5.2 to 3.6.0
- [Release notes](https://github.com/ktorio/ktor/releases)
- [Changelog](https://github.com/ktorio/ktor/blob/main/CHANGELOG.md)
- [Commits](ktorio/ktor@3.5.2...3.6.0)

---
updated-dependencies:
- dependency-name: io.ktor:ktor-client-content-negotiation
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: io.ktor:ktor-client-core
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: io.ktor:ktor-client-cio
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: io.ktor:ktor-client-logging
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: io.ktor:ktor-client-mock
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: io.ktor:ktor-client-okhttp
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: io.ktor:ktor-client-websockets
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: io.ktor:ktor-io
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: io.ktor:ktor-network
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: io.ktor:ktor-serialization-kotlinx-json
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: io.ktor:ktor-server-cio
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: io.ktor:ktor-server-compression
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: io.ktor:ktor-server-content-negotiation
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: io.ktor:ktor-server-core
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: io.ktor:ktor-server-status-pages
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: io.ktor:ktor-server-test-host
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: io.ktor:ktor-server-websockets
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added Dependencies Pull requests that update a dependency file java Pull requests that update java code labels Sep 24, 2026
@guiyanakuang

guiyanakuang commented Sep 24, 2026

Copy link
Copy Markdown
Member

Closing this for now: ktor 3.6.0 ships a regression in ktor-server-test-host that hangs every testApplication test whose response body is an unbounded stream, and our CLI watch endpoint (NDJSON, never completes on its own) is exactly that.

What fails

The 5 CliRoutingTest watch ... tests time out with UncompletedCoroutinesError: After waiting for 1m, the test body did not run to completion. The watch rejects unknown type and tag before streaming test, which answers 400 without streaming, still passes. Reproduced locally on this branch; the same class is green on 3.5.2.

Root cause

KTOR-8705 (ktorio/ktor#5868, in 3.6.0) changed TestApplicationResponse.respondWriteChannelContent from scope.writer { ... } to scope.writer(currentCoroutineContext()) { ... }. The passed context carries the request's Job, so the body writer becomes a child of the withContext block in TestApplicationEngine.handleRequest. That block now cannot return until the writer finishes, and TestHttpClientEngine.execute only builds the client response after handleRequest returns. Any respondBytesWriter body that keeps streaming (SSE-style heartbeats, our watch feed) therefore blocks the test client forever; the response never even reaches prepareGet().execute { }.

The upstream fix is ktorio/ktor#5880 (scope.writer(currentCoroutineContext().minusKey(Job)), with a testValidHandlerContextWhenStreaming test that uses awaitCancellation() in the writer). It is still open and targets main, so it is not in 3.6.0 and not yet on release/3.x.

Decision

Nothing in 3.6.0 is security-related for us and the production CIO engine is unaffected, so there is no reason to work around a test-host bug on our side. Skip 3.6.0; Dependabot will open a new PR when a release containing the fix (3.6.1 or later) is published, and that one should go green as-is.

@dependabot @github

dependabot Bot commented on behalf of github Sep 24, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/gradle/ktor-3.6.0 branch September 24, 2026 01:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

Dependencies Pull requests that update a dependency file java Pull requests that update java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@guiyanakuang