chore(deps): bump the kotlin group across 1 directory with 6 updates

[dependabot]

Bumps the kotlin group with 6 updates in the / directory:

Package	From	To
io.ktor:ktor-serialization-kotlinx-json	3.4.3	3.5.1
org.jetbrains.kotlin.plugin.serialization	2.3.21	2.4.0
org.jetbrains.kotlin.multiplatform	2.3.21	2.4.0
org.jetbrains.kotlin.android	2.3.21	2.4.0
org.jetbrains.kotlin.plugin.compose	2.3.21	2.4.0
com.google.devtools.ksp	2.2.20-2.0.4	2.3.9

Updates io.ktor:ktor-serialization-kotlinx-json from 3.4.3 to 3.5.1

Release notes

Sourced from io.ktor:ktor-serialization-kotlinx-json's releases.

3.5.1

Published 25 June 2026

Improvements

• KTOR-9492 OpenAPI plugin: handle requireXxx functions in compiler plugin
• KTOR-9569 Add more details for KDoc of BearerAuthConfig.sendWithoutRequest
• KTOR-9571 Add KDoc for BearerAuthConfig.realm
• KTOR-9570 Add Kdoc for BearerAuthConfig.refreshTokens

Bugfixes

• KTOR-9646 Fix Kotlin 2.4.0 compiler plugin breaking changes
• KTOR-9585 OpenAPI: JsonSchema title is truncated when it contains a dot
• KTOR-9591 OpenAPI: @JsonClassDiscriminator on sealed types is ignored when generating OpenAPI discriminator schema
• KTOR-9597 OpenAPI: Schema name collisions because@SerialName of sealed subtypes is used as components.schemas key
• KTOR-9601 OpenAPI: nullable @​JvmInline value class loses nullability in generated schema
• KTOR-9620 Some issues related to digest authentication in 3.5.0
• KTOR-9623 Digest Auth: server must respond with one WWW-Authenticate header for each supported algorithm
• KTOR-9624 Digest Auth: "Unsupported charset in digest authentication header" for a charset name in lowercase
• KTOR-9630 Digest Auth: The plugin sends incorrect nonce when server responds with multiple WWW-Authenticate headers
• KTOR-9565 WebRTC: Peer stops receiving messages after a while on iOS
• KTOR-9610 WebRtcPeerConnection::close causes ClosedReceiveChannelException for other peer
• KTOR-9633 WebRTC statistics fetching race condition
• KTOR-9603 Structured concurrency is violated in WebRTC tests
• KTOR-9671 Darwin: Semicolons in URL path are sanitized
• KTOR-9639 Darwin: WebSocket client crashes the process when a PONG arrives after the session is closed
• KTOR-9575 Darwin: findCharset("UTF-16") maps to NSUTF16LittleEndianStringEncoding causing decoding failure for UTF-16 content with BOM
• KTOR-9661 HttpCache: InvalidCacheStateException is thrown on 304 when no cached entry matches varyKeys
• KTOR-9673 Caching always missing with Content Negotiation
• KTOR-9596 HttpTimeout: HttpRequestTimeoutException on any request with runTest and request timeout defined since 3.5.0
• KTOR-9632 HttpRequestBuilder.timeout call removes capabilities set in DefaultRequest
• KTOR-9252 ContentEncoding: Incomplete gzip response causes client/server to hang indefinitely
• KTOR-9670 Compression: The plugin ignores Accept-Encoding q=0 and most-specific matching
• KTOR-9614 Zstd Compression: "Destination buffer is too small" exception for a particular sequence of bytes
• KTOR-9636 CORS plugin drops OPTIONS preflight requests when allowSameOrigin is on
• KTOR-9659 CORS is skipped when the Origin header contains an IPv6 address
• KTOR-9574 ContentNegotiation: The charset of Accept-Charset header is used for response deserialization
• KTOR-9606 KotlinxSerializationConverter: it fails to deserialize an empty channel closed with a delay
• KTOR-9617 OutputStreamContent and WriterContent can exhaust Dispatchers.IO
• KTOR-9629 RawSourceChannel: coroutine cancellation is not propagated to the RawSource
• KTOR-8870 File.readChannel: do not close a non-opened file and ignore closing exceptions
• KTOR-9460 Curl: Can't build shared library with Ktor 3.4.2
• KTOR-9607 Crash on Android 7: NoSuchMethodError getInstanceStrong() since 3.5.0
• KTOR-9595 CIO: The engine imports node:net statically and breaks wasmJsBrowser webpack build
• KTOR-9615 Apache5: The underlying request is not aborted when coroutine Job is cancelled
• KTOR-8443 RoutingBuilder.contentType does not use parameters when matching
• KTOR-9425 SessionTransportTransformerEncrypt init block uses wrong IV size for AES-256 (regression of KTOR-661)
• KTOR-9621 RateLimit plugin is bypassed when the nested authenticate block rejects the request
• KTOR-8766 DI: The close method is called twice on cleanup of AutoCloseable
• KTOR-8695 GMTDate() being offset by 369 years on Windows
• KTOR-9589 Duplicate PROPERTY_SETTER target in @InternalAPI annotation

... (truncated)

Changelog

Sourced from io.ktor:ktor-serialization-kotlinx-json's changelog.

3.5.1

Published 25 June 2026

Improvements

• KTOR-9492 OpenAPI plugin: handle requireXxx functions in compiler plugin
• KTOR-9569 Add more details for KDoc of BearerAuthConfig.sendWithoutRequest
• KTOR-9571 Add KDoc for BearerAuthConfig.realm
• KTOR-9570 Add Kdoc for BearerAuthConfig.refreshTokens

Bugfixes

• KTOR-9646 Fix Kotlin 2.4.0 compiler plugin breaking changes
• KTOR-9585 OpenAPI: JsonSchema title is truncated when it contains a dot
• KTOR-9591 OpenAPI: @JsonClassDiscriminator on sealed types is ignored when generating OpenAPI discriminator schema
• KTOR-9597 OpenAPI: Schema name collisions because@SerialName of sealed subtypes is used as components.schemas key
• KTOR-9601 OpenAPI: nullable @​JvmInline value class loses nullability in generated schema
• KTOR-9620 Some issues related to digest authentication in 3.5.0
• KTOR-9623 Digest Auth: server must respond with one WWW-Authenticate header for each supported algorithm
• KTOR-9624 Digest Auth: "Unsupported charset in digest authentication header" for a charset name in lowercase
• KTOR-9630 Digest Auth: The plugin sends incorrect nonce when server responds with multiple WWW-Authenticate headers
• KTOR-9565 WebRTC: Peer stops receiving messages after a while on iOS
• KTOR-9610 WebRtcPeerConnection::close causes ClosedReceiveChannelException for other peer
• KTOR-9633 WebRTC statistics fetching race condition
• KTOR-9603 Structured concurrency is violated in WebRTC tests
• KTOR-9671 Darwin: Semicolons in URL path are sanitized
• KTOR-9639 Darwin: WebSocket client crashes the process when a PONG arrives after the session is closed
• KTOR-9575 Darwin: findCharset("UTF-16") maps to NSUTF16LittleEndianStringEncoding causing decoding failure for UTF-16 content with BOM
• KTOR-9661 HttpCache: InvalidCacheStateException is thrown on 304 when no cached entry matches varyKeys
• KTOR-9673 Caching always missing with Content Negotiation
• KTOR-9596 HttpTimeout: HttpRequestTimeoutException on any request with runTest and request timeout defined since 3.5.0
• KTOR-9632 HttpRequestBuilder.timeout call removes capabilities set in DefaultRequest
• KTOR-9252 ContentEncoding: Incomplete gzip response causes client/server to hang indefinitely
• KTOR-9670 Compression: The plugin ignores Accept-Encoding q=0 and most-specific matching
• KTOR-9614 Zstd Compression: "Destination buffer is too small" exception for a particular sequence of bytes
• KTOR-9636 CORS plugin drops OPTIONS preflight requests when allowSameOrigin is on
• KTOR-9659 CORS is skipped when the Origin header contains an IPv6 address
• KTOR-9574 ContentNegotiation: The charset of Accept-Charset header is used for response deserialization
• KTOR-9606 KotlinxSerializationConverter: it fails to deserialize an empty channel closed with a delay
• KTOR-9617 OutputStreamContent and WriterContent can exhaust Dispatchers.IO
• KTOR-9629 RawSourceChannel: coroutine cancellation is not propagated to the RawSource
• KTOR-8870 File.readChannel: do not close a non-opened file and ignore closing exceptions
• KTOR-9460 Curl: Can't build shared library with Ktor 3.4.2
• KTOR-9607 Crash on Android 7: NoSuchMethodError getInstanceStrong() since 3.5.0
• KTOR-9595 CIO: The engine imports node:net statically and breaks wasmJsBrowser webpack build
• KTOR-9615 Apache5: The underlying request is not aborted when coroutine Job is cancelled
• KTOR-8443 RoutingBuilder.contentType does not use parameters when matching
• KTOR-9425 SessionTransportTransformerEncrypt init block uses wrong IV size for AES-256 (regression of KTOR-661)
• KTOR-9621 RateLimit plugin is bypassed when the nested authenticate block rejects the request
• KTOR-8766 DI: The close method is called twice on cleanup of AutoCloseable
• KTOR-8695 GMTDate() being offset by 369 years on Windows
• KTOR-9589 Duplicate PROPERTY_SETTER target in @​InternalAPI annotation

... (truncated)

Commits

• 5ba9d6f Release 3.5.1 (#5719)
• a4f145d KTOR-9661 HttpCache: InvalidCacheStateException is thrown on 304 when… (#5701)
• 2caf278 Fix failing :ktor-io:compileDarwinMainKotlinMetadata (#5716)
• 257de90 KTOR-8766 Fix multiple invocations of close from DI
• e77a168 Fix cache misses with content negotiation 3x (#5714)
• ed22950 Make huge post test less huge
• f329069 Update dependency com.github.luben:zstd-jni to v1.5.7-11
• 6ecd072 Update dependency io.swagger.parser.v3:swagger-parser to v2.1.44
• a0534cd Update dependency io.pebbletemplates:pebble to v4.1.2
• 8647e53 Update dependency com.typesafe:config to v1.4.9
• Additional commits viewable in compare view

Updates org.jetbrains.kotlin.plugin.serialization from 2.3.21 to 2.4.0

Updates org.jetbrains.kotlin.multiplatform from 2.3.21 to 2.4.0

Updates org.jetbrains.kotlin.android from 2.3.21 to 2.4.0

Updates org.jetbrains.kotlin.plugin.compose from 2.3.21 to 2.4.0

Updates org.jetbrains.kotlin.multiplatform from 2.3.21 to 2.4.0

Updates org.jetbrains.kotlin.android from 2.3.21 to 2.4.0

Updates com.google.devtools.ksp from 2.2.20-2.0.4 to 2.3.9

Release notes

Sourced from com.google.devtools.ksp's releases.

2.3.9

What's Changed

• Cleaned up native cross-compilation support checks to prevent Gradle Configuration Cache invalidation (#2953)
• Fixed a compilation performance regression in in PsiResolutionStrategy introduced in 2.3.8 (#2948)

Contributors

• Thanks to everyone who reported bugs and participated in discussions!

Full Changelog: google/ksp@2.3.8...2.3.9

2.3.8

What's Changed

• Enabled new default annotation use-site rules in Kotlin's Analysis API (see KEEP 402) for more information. Note: KSP was already mostly compatible with KEEP 402, so there shouldn't be any visible changes for users. (#2888)
• Enabled ksp.project.isolation by default when Gradle isolated projects are enabled (#2866)
• Improved getSymbolsWithAnnotation performance by implementing a new PSI-based resolution strategy (#2816)

Contributors

• Thanks to @​hugoncosta and everyone who reported bugs and participated in discussions!

Full Changelog: google/ksp@2.3.7...2.3.8

2.3.7

What's Changed

• Bumped Kotlin target language version to 2.3 (#2821)
• Fixed crash caused by upstream dependency (#2856)
• Fixed support for Gradle Isolated Projects (#2844)

Contributors

• Thanks to everyone who reported bugs and participated in discussions!

Full Changelog: google/ksp@2.3.6...2.3.7

2.3.6

What's Changed

• Fixed an issue where module recompilation would fail on Windows environments when KSP2 was enabled (#2774)
• Resolved an issue where generated Java sources were ignored when using Android Kotlin Multiplatform with IP-compatible paths (#2744)
• Fixed a KSP version 2.3.5 CI error exception that does not break build checks (#2763)
• Added symbol-processing-api and common-deps to compile dependencies (#2789)
• Improved the detection of built-in Kotlin by removing the reliance on KotlinBaseApiPlugin (#2772)
• A back-port of a performance optimization in the Intellij / Analysis API (2785 )
• Added support for nested typealias Kotlin language feature #2588
• Exclude jdbc package from log4j to prevent vulnerability issue #2651

Contributors

• Thanks to @​salmanmkc, @​jaschdoc, @​gurusai-voleti and everyone who reported bugs and participated in discussions!

Full Changelog: google/ksp@2.3.5...2.3.6

2.3.5

What's Changed

... (truncated)

Commits

• 799f6c1 Add unused test
• 0410308 return to using kgp api but gate with if statement
• 3b0ae6d Consolidate klib cross-compilation support check on KGP property
• 9746fb5 Add test for self referencing type variables
• b61da98 Fix release branch cherry-picking
• 555120d Add copyright header
• 1a80a30 Revert "Refactor CollectAnnotatedSymbolsPsiVisitor"
• b6684d4 Update auto-merge.yml to 2.3.9-release branch
• d350521 Add test for context parameters
• 811dbfe Merge test directories
• Additional commits viewable in compare view

Updates org.jetbrains.kotlin.plugin.compose from 2.3.21 to 2.4.0