Skip to content

Bump the all group with 14 updates - #384

Merged
IRus merged 2 commits into
mainfrom
dependabot/gradle/all-b0e577d11b
Sep 13, 2026
Merged

Bump the all group with 14 updates#384
IRus merged 2 commits into
mainfrom
dependabot/gradle/all-b0e577d11b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 13, 2026

Copy link
Copy Markdown
Contributor

Bumps the all group with 14 updates:

Package From To
org.http4k:http4k-server-netty 6.58.0.0 6.59.0.0
com.squareup:kotlinpoet 2.3.0 2.4.0
com.squareup:kotlinpoet-ksp 2.3.0 2.4.0
com.google.devtools.ksp:symbol-processing-api 2.3.11 2.3.12
com.google.devtools.ksp 2.3.11 2.3.12
org.mongodb:mongodb-driver-kotlin-coroutine 5.11.0 5.11.1
io.netty:netty-all 4.2.17.Final 4.2.18.Final
io.netty:netty-transport-native-kqueue 4.2.17.Final 4.2.18.Final
io.netty:netty-transport-native-epoll 4.2.17.Final 4.2.18.Final
io.netty:netty-transport-native-io_uring 4.2.17.Final 4.2.18.Final
org.slf4j:slf4j-api 2.0.18 2.0.19
org.jetbrains.kotlin.jvm 2.4.10 2.4.20
org.jetbrains.kotlin.multiplatform 2.4.10 2.4.20
org.jetbrains.kotlin.plugin.serialization 2.4.10 2.4.20

Updates org.http4k:http4k-server-netty from 6.58.0.0 to 6.59.0.0

Release notes

Sourced from org.http4k:http4k-server-netty's releases.

6.59.0.0

Distribution notice - from 1 October 2026, Maven Central receives http4k releases approximately quarterly. maven.http4k.org continues on the normal 1-2 week cadence. Both channels are supported. Background and current status: DISTRIBUTION.md

Changelog:

  • http4k-*: Upgrade versions & Gradle
  • http4k-ai-core: [Break] toCompletionSequence is replaced by toSseSequence and toJsonLinesSequence.
  • http4k-web-htmx: [Break] Upgrade to HTMX 4.0.0 so webjars will have changed URL and version we are shipping. If you're not on HTMX 4 then expect breaks.
  • http4k-connect-ai-anthropic-*: [Break] The Messages API model is much more complete, so a few things move. In rough order of how likely you are to hit them:
    • Handling response content: Content has many more arms plus an Unknown.
    • Setting a system prompt: system is a List<Content.Text> rather than a SystemPrompt.
    • Using tools: Tool(name, description, schema) becomes Tool.User(name, schema, description), and ToolResult.content is a List<Content> rather than Any.
    • Sending images: Source(data, mediaType) becomes Source.Base64(data, mediaType).
    • Streaming: MessageGenerationEvent gains StopMessage at the end of the stream and an Unknown arm, and Error carries ErrorDetail(type, message).
  • http4k-postbox: [New module!] Reliable asynchronous processing of HTTP requests using http4k's uniform transactional outbox/inbox pattern
  • http4k-connect-amazon-cognitoidentity-fake: [New module!] Amazon Cognito Identity fake, backed by a Storage<StoredIdentity>. One identity per pool and set of logins, as the real service does. H/T @​torfinnberset
  • http4k-connect-amazon-xray: [New module!] AWS X-Ray read APIs, covering GetTraceSummaries and BatchGetTraces. Segment documents are returned as the raw JSON X-Ray stores; the root-cause structures of a trace summary are not modelled. H/T @​torfinnberset
  • http4k-connect-amazon-xray-fake: [New module!] AWS X-Ray fake, backed by a Storage<StoredTrace>. It evaluates annotation.<key> = "<value>" filter expressions and refuses any other, rather than answering with every trace in the window. H/T @​torfinnberset
  • http4k-format-kotlinx-serialization: [Fix #1609] Parse rejects top-level arrays, silently dropping OpenAPI examples for list bodies. H/T @​cies
  • http4k-format-jackson-csv: [Fix] CSV deserialization column ordering and unknown columns handling H/T @​aharin
  • http4k-connect-amazon-dynamodb-fake: [Fix] failed TransactWriteItems now returns the same TransactionCanceledException error as DynamoDB, with a reason for each item. H/T @​torfinnberset
  • http4k-connect-ai-anthropic-*: [Fix] temperature, top_k and top_p only sent when set. Opus 4.7+, preventing request failure.
  • http4k-ai-llm-anthropic: [Fix] Claude 5 models return a Thinking block by default, which the chat shim rejected.
  • http4k-connect-ai-anthropic-fake: [Fix] Streamed responses emit a complete event sequence.
  • http4k-connect-amazon-iot: DescribeCertificate, which reads a certificate's status, owner, mode and validity window from its id. H/T @​torfinnberset
  • http4k-connect-amazon-iot-fake: DescribeCertificate, backed by a Storage<StoredCertificate>. H/T @​torfinnberset
  • http4k-connect-amazon-sqs: ChangeMessageVisibility, which returns a received message to the queue early (timeout 0) or extends the time a consumer holds it. H/T @​torfinnberset
  • http4k-connect-amazon-sqs-fake: ChangeMessageVisibility. Received messages stay visible in the fake, so the call only checks that the queue exists. H/T @​torfinnberset
  • http4k-core: [Deprecation] Align ResponseLens/ResponseKet lenses with Request equivalents. H/T @​aharin
Changelog

Sourced from org.http4k:http4k-server-netty's changelog.

v6.59.0.0

  • http4k-*: Upgrade versions & Gradle
  • http4k-ai-core: [Break] toCompletionSequence is replaced by toSseSequence and toJsonLinesSequence.
  • http4k-web-htmx: [Break] Upgrade to HTMX 4.0.0 so webjars will have changed URL and version we are shipping. If you're not on HTMX 4 then expect breaks.
  • http4k-connect-ai-anthropic-*: [Break] The Messages API model is much more complete, so a few things move. In rough order of how likely you are to hit them:
    • Handling response content: Content has many more arms plus an Unknown.
    • Setting a system prompt: system is a List<Content.Text> rather than a SystemPrompt.
    • Using tools: Tool(name, description, schema) becomes Tool.User(name, schema, description), and ToolResult.content is a List<Content> rather than Any.
    • Sending images: Source(data, mediaType) becomes Source.Base64(data, mediaType).
    • Streaming: MessageGenerationEvent gains StopMessage at the end of the stream and an Unknown arm, and Error carries ErrorDetail(type, message).
  • http4k-postbox: [New module!] Reliable asynchronous processing of HTTP requests using http4k's uniform transactional outbox/inbox pattern
  • http4k-connect-amazon-cognitoidentity-fake: [New module!] Amazon Cognito Identity fake, backed by a Storage<StoredIdentity>. One identity per pool and set of logins, as the real service does. H/T @​torfinnberset
  • http4k-connect-amazon-xray: [New module!] AWS X-Ray read APIs, covering GetTraceSummaries and BatchGetTraces. Segment documents are returned as the raw JSON X-Ray stores; the root-cause structures of a trace summary are not modelled. H/T @​torfinnberset
  • http4k-connect-amazon-xray-fake: [New module!] AWS X-Ray fake, backed by a Storage<StoredTrace>. It evaluates annotation.<key> = "<value>" filter expressions and refuses any other, rather than answering with every trace in the window. H/T @​torfinnberset
  • http4k-format-kotlinx-serialization: [Fix #1609] Parse rejects top-level arrays, silently dropping OpenAPI examples for list bodies. H/T @​cies
  • http4k-format-jackson-csv: [Fix] CSV deserialization column ordering and unknown columns handling H/T @​aharin
  • http4k-connect-amazon-dynamodb-fake: [Fix] failed TransactWriteItems now returns the same TransactionCanceledException error as DynamoDB, with a reason for each item. H/T @​torfinnberset
  • http4k-connect-ai-anthropic-*: [Fix] temperature, top_k and top_p only sent when set. Opus 4.7+, preventing request failure.
  • http4k-ai-llm-anthropic: [Fix] Claude 5 models return a Thinking block by default, which the chat shim rejected.
  • http4k-connect-ai-anthropic-fake: [Fix] Streamed responses emit a complete event sequence.
  • http4k-connect-amazon-iot: DescribeCertificate, which reads a certificate's status, owner, mode and validity window from its id. H/T @​torfinnberset
  • http4k-connect-amazon-iot-fake: DescribeCertificate, backed by a Storage<StoredCertificate>. H/T @​torfinnberset
  • http4k-connect-amazon-sqs: ChangeMessageVisibility, which returns a received message to the queue early (timeout 0) or extends the time a consumer holds it. H/T @​torfinnberset
  • http4k-connect-amazon-sqs-fake: ChangeMessageVisibility. Received messages stay visible in the fake, so the call only checks that the queue exists. H/T @​torfinnberset
  • http4k-core: [Deprecation] Align ResponseLens/ResponseKet lenses with Request equivalents. H/T @​aharin

v6.58.1.0

  • http4k-*: Upgrade versions & Gradle
  • http4k-template-kotlinx-html: [New module!] Renders kotlinx-html DSL views as http4k TemplateRenderers.
Commits

Updates com.squareup:kotlinpoet from 2.3.0 to 2.4.0

Release notes

Sourced from com.squareup:kotlinpoet's releases.

2.4.0

Thanks to @​eyupcanakman and @​arimu1 for contributing to this release.

  • New: Kotlin 2.4.20.
  • New: KSP 2.3.11.
  • New: Support for explicit backing fields. (#2325)
  • New: value class validations have been relaxed to support multi-field value classes. (#2329)
  • New: Extract CodeBlockHolder interface for constructs that can hold a CodeBlock body and their builders. (#2331)
  • New: Add CodeBlock.Builder.addComment() for adding // comments. (#2340)
  • New: Add CodeBlockHolder.Builder.addComment(). (#2347)
  • New: Use [] syntax instead of arrayOf when emitting annotation arguments. (#2361)
  • Fix: Keep the // prefix on wrapped file comment lines. (#2315)
  • Fix: TypeVariableName.equals/hashCode no longer overflow on recursively bound generics like Enum<E : Enum<E>>. (#2320)
  • Fix: get and set operator function names are no longer escaped with backticks. (#2338)
  • Fix: Don't special case varargs in KSAnnotation.toAnnotationSpec. (#2360)
  • Fix: KSType.toTypeName() with the default TypeParameterResolver.EMPTY now resolves type parameters from their enclosing declarations instead of throwing. (#2368)
  • Fix: Emit context parameters after annotations in FunSpec and PropertySpec. (#2374)
  • Fix: An expression body no longer leaks indentation into later declarations. (#2365)
Changelog

Sourced from com.squareup:kotlinpoet's changelog.

Version 2.4.0

Thanks to [@​eyupcanakman][eyupcanakman] and [@​arimu1][arimu1] for contributing to this release.

2026-09-07

  • New: Kotlin 2.4.20.
  • New: KSP 2.3.11.
  • New: Support for explicit backing fields. (#2325)
  • New: value class validations have been relaxed to support multi-field value classes. (#2329)
  • New: Extract CodeBlockHolder interface for constructs that can hold a CodeBlock body and their builders. (#2331)
  • New: Add CodeBlock.Builder.addComment() for adding // comments. (#2340)
  • New: Add CodeBlockHolder.Builder.addComment(). (#2347)
  • New: Use [] syntax instead of arrayOf when emitting annotation arguments. (#2361)
  • Fix: Keep the // prefix on wrapped file comment lines. (#2315)
  • Fix: TypeVariableName.equals/hashCode no longer overflow on recursively bound generics like Enum<E : Enum<E>>. (#2320)
  • Fix: get and set operator function names are no longer escaped with backticks. (#2338)
  • Fix: Don't special case varargs in KSAnnotation.toAnnotationSpec. (#2360)
  • Fix: KSType.toTypeName() with the default TypeParameterResolver.EMPTY now resolves type parameters from their enclosing declarations instead of throwing. (#2368)
  • Fix: Emit context parameters after annotations in FunSpec and PropertySpec. (#2374)
  • Fix: An expression body no longer leaks indentation into later declarations. (#2365)
Commits
  • 97e504b Prepare for release 2.4.0.
  • fcd0f3c Update kotlin monorepo to v2.4.20 (#2379)
  • 354c921 Update plugin spotless to v8.10.2
  • 789311f Update plugin kotlinBinaryCompatibilityValidator to v0.18.2 (#2377)
  • c0d8293 Don't throw when toTypeName() hits type parameters with EMPTY resolver (#2368)
  • ae26f24 Don't leak an expression body's indent into later declarations (#2365)
  • c42a4ef Update plugin spotless to v8.10.1
  • 422f3b4 Emit context parameters after annotations in FunSpec and PropertySpec (#2374)
  • 4e91626 Update dependency click to v8.5.0 (#2371)
  • c6742fd Update actions/setup-java action to v6 (#2370)
  • Additional commits viewable in compare view

Updates com.squareup:kotlinpoet-ksp from 2.3.0 to 2.4.0

Release notes

Sourced from com.squareup:kotlinpoet-ksp's releases.

2.4.0

Thanks to @​eyupcanakman and @​arimu1 for contributing to this release.

  • New: Kotlin 2.4.20.
  • New: KSP 2.3.11.
  • New: Support for explicit backing fields. (#2325)
  • New: value class validations have been relaxed to support multi-field value classes. (#2329)
  • New: Extract CodeBlockHolder interface for constructs that can hold a CodeBlock body and their builders. (#2331)
  • New: Add CodeBlock.Builder.addComment() for adding // comments. (#2340)
  • New: Add CodeBlockHolder.Builder.addComment(). (#2347)
  • New: Use [] syntax instead of arrayOf when emitting annotation arguments. (#2361)
  • Fix: Keep the // prefix on wrapped file comment lines. (#2315)
  • Fix: TypeVariableName.equals/hashCode no longer overflow on recursively bound generics like Enum<E : Enum<E>>. (#2320)
  • Fix: get and set operator function names are no longer escaped with backticks. (#2338)
  • Fix: Don't special case varargs in KSAnnotation.toAnnotationSpec. (#2360)
  • Fix: KSType.toTypeName() with the default TypeParameterResolver.EMPTY now resolves type parameters from their enclosing declarations instead of throwing. (#2368)
  • Fix: Emit context parameters after annotations in FunSpec and PropertySpec. (#2374)
  • Fix: An expression body no longer leaks indentation into later declarations. (#2365)
Changelog

Sourced from com.squareup:kotlinpoet-ksp's changelog.

Version 2.4.0

Thanks to [@​eyupcanakman][eyupcanakman] and [@​arimu1][arimu1] for contributing to this release.

2026-09-07

  • New: Kotlin 2.4.20.
  • New: KSP 2.3.11.
  • New: Support for explicit backing fields. (#2325)
  • New: value class validations have been relaxed to support multi-field value classes. (#2329)
  • New: Extract CodeBlockHolder interface for constructs that can hold a CodeBlock body and their builders. (#2331)
  • New: Add CodeBlock.Builder.addComment() for adding // comments. (#2340)
  • New: Add CodeBlockHolder.Builder.addComment(). (#2347)
  • New: Use [] syntax instead of arrayOf when emitting annotation arguments. (#2361)
  • Fix: Keep the // prefix on wrapped file comment lines. (#2315)
  • Fix: TypeVariableName.equals/hashCode no longer overflow on recursively bound generics like Enum<E : Enum<E>>. (#2320)
  • Fix: get and set operator function names are no longer escaped with backticks. (#2338)
  • Fix: Don't special case varargs in KSAnnotation.toAnnotationSpec. (#2360)
  • Fix: KSType.toTypeName() with the default TypeParameterResolver.EMPTY now resolves type parameters from their enclosing declarations instead of throwing. (#2368)
  • Fix: Emit context parameters after annotations in FunSpec and PropertySpec. (#2374)
  • Fix: An expression body no longer leaks indentation into later declarations. (#2365)
Commits
  • 97e504b Prepare for release 2.4.0.
  • fcd0f3c Update kotlin monorepo to v2.4.20 (#2379)
  • 354c921 Update plugin spotless to v8.10.2
  • 789311f Update plugin kotlinBinaryCompatibilityValidator to v0.18.2 (#2377)
  • c0d8293 Don't throw when toTypeName() hits type parameters with EMPTY resolver (#2368)
  • ae26f24 Don't leak an expression body's indent into later declarations (#2365)
  • c42a4ef Update plugin spotless to v8.10.1
  • 422f3b4 Emit context parameters after annotations in FunSpec and PropertySpec (#2374)
  • 4e91626 Update dependency click to v8.5.0 (#2371)
  • c6742fd Update actions/setup-java action to v6 (#2370)
  • Additional commits viewable in compare view

Updates com.squareup:kotlinpoet-ksp from 2.3.0 to 2.4.0

Release notes

Sourced from com.squareup:kotlinpoet-ksp's releases.

2.4.0

Thanks to @​eyupcanakman and @​arimu1 for contributing to this release.

  • New: Kotlin 2.4.20.
  • New: KSP 2.3.11.
  • New: Support for explicit backing fields. (#2325)
  • New: value class validations have been relaxed to support multi-field value classes. (#2329)
  • New: Extract CodeBlockHolder interface for constructs that can hold a CodeBlock body and their builders. (#2331)
  • New: Add CodeBlock.Builder.addComment() for adding // comments. (#2340)
  • New: Add CodeBlockHolder.Builder.addComment(). (#2347)
  • New: Use [] syntax instead of arrayOf when emitting annotation arguments. (#2361)
  • Fix: Keep the // prefix on wrapped file comment lines. (#2315)
  • Fix: TypeVariableName.equals/hashCode no longer overflow on recursively bound generics like Enum<E : Enum<E>>. (#2320)
  • Fix: get and set operator function names are no longer escaped with backticks. (#2338)
  • Fix: Don't special case varargs in KSAnnotation.toAnnotationSpec. (#2360)
  • Fix: KSType.toTypeName() with the default TypeParameterResolver.EMPTY now resolves type parameters from their enclosing declarations instead of throwing. (#2368)
  • Fix: Emit context parameters after annotations in FunSpec and PropertySpec. (#2374)
  • Fix: An expression body no longer leaks indentation into later declarations. (#2365)
Changelog

Sourced from com.squareup:kotlinpoet-ksp's changelog.

Version 2.4.0

Thanks to [@​eyupcanakman][eyupcanakman] and [@​arimu1][arimu1] for contributing to this release.

2026-09-07

  • New: Kotlin 2.4.20.
  • New: KSP 2.3.11.
  • New: Support for explicit backing fields. (#2325)
  • New: value class validations have been relaxed to support multi-field value classes. (#2329)
  • New: Extract CodeBlockHolder interface for constructs that can hold a CodeBlock body and their builders. (#2331)
  • New: Add CodeBlock.Builder.addComment() for adding // comments. (#2340)
  • New: Add CodeBlockHolder.Builder.addComment(). (#2347)
  • New: Use [] syntax instead of arrayOf when emitting annotation arguments. (#2361)
  • Fix: Keep the // prefix on wrapped file comment lines. (#2315)
  • Fix: TypeVariableName.equals/hashCode no longer overflow on recursively bound generics like Enum<E : Enum<E>>. (#2320)
  • Fix: get and set operator function names are no longer escaped with backticks. (#2338)
  • Fix: Don't special case varargs in KSAnnotation.toAnnotationSpec. (#2360)
  • Fix: KSType.toTypeName() with the default TypeParameterResolver.EMPTY now resolves type parameters from their enclosing declarations instead of throwing. (#2368)
  • Fix: Emit context parameters after annotations in FunSpec and PropertySpec. (#2374)
  • Fix: An expression body no longer leaks indentation into later declarations. (#2365)
Commits
  • 97e504b Prepare for release 2.4.0.
  • fcd0f3c Update kotlin monorepo to v2.4.20 (#2379)
  • 354c921 Update plugin spotless to v8.10.2
  • 789311f Update plugin kotlinBinaryCompatibilityValidator to v0.18.2 (#2377)
  • c0d8293 Don't throw when toTypeName() hits type parameters with EMPTY resolver (#2368)
  • ae26f24 Don't leak an expression body's indent into later declarations (#2365)
  • c42a4ef Update plugin spotless to v8.10.1
  • 422f3b4 Emit context parameters after annotations in FunSpec and PropertySpec (#2374)
  • 4e91626 Update dependency click to v8.5.0 (#2371)
  • c6742fd Update actions/setup-java action to v6 (#2370)
  • Additional commits viewable in compare view

Updates com.google.devtools.ksp:symbol-processing-api from 2.3.11 to 2.3.12

Release notes

Sourced from com.google.devtools.ksp:symbol-processing-api's releases.

2.3.12

What's Changed

Migrating Processors to Support Backing Fields

This release introduces support for explicit backing fields (#2873 ), which may now be returned by Resolver.getSymbolsWithAnnotation. To prevent breaking existing processors, new language features require an explicit opt-in.

Processors adapting to new features must opt in via both of the following steps simultaneously (failing to do both may lead to undefined behavior):

  1. The processor should call the registerProcessorForNewFeatures function in SymbolProcessorEnvironment immediately when created (and only once). Example: AbstractTestProcessor.kt#L30
  2. All implementations of KSVisitor should move to KSVisitorNext. If their processor code does not directly implement the interface but instead extends one of the KSP-provided visitors (such as KSTopDownVisitor), they should instead extend KSTopDownVisitor(enableNewFeatures = true) and override visitBackingField depending on their code and needs.

Bug Fixes

  • Fix Resolver.getDeclarationsFromPackage returning incomplete declarations from KLibs in Kotlin Multiplatform (#2396)
  • Fix KSP CLI process hanging indefinitely when a processor throws an unhandled exception (#3120)
  • Fix implicit task dependency error between KSP and Android Lint in Android KMP (#3128)
  • Fix NullPointerException by registering PluginProblemReporter as an application service (#3140)
  • Do not mark companion objects as JAVA_STATIC in Resolver.effectiveJavaModifiers (#3125)
  • Fix JAVA_STATIC modifier resolution for @​JvmStatic members in Resolver.effectiveJavaModifiers (#3124)
  • Update minimum supported Android Gradle Plugin (AGP) version to 8.12.0 (#3149)

New Contributors

Thanks to @​KlyneChrysler, @​budindepunk, and everyone who reported bugs and participated in discussions!

Full Changelog: google/ksp@2.3.11...2.3.12

Commits
  • a3c3859 Format Resolver file
  • a614317 Fix grammatical errors in Resolver doc comments
  • c19f255 Merge equal EXPECT NEXT and EXPECT CURRENT in javaBackingFieldUsedInKotlin
  • d3df886 Add test for getting default annotation values in KMP
  • 3bcac20 Mark testJavaBackingFieldUsedInKotlin as fixed
  • e74bb5f Update expected test output in libOrigins
  • c9b1d40 Use KSSyntheticJavaBackingFieldImpl in KSPropertyDeclarationImpl
  • afefe15 Add KSSyntheticJavaBackingFieldImpl
  • 2da07c1 Add test for missing synthetic Java fields
  • 7033530 Fix visibility modifiers for Kotlin-based backing fields
  • Additional commits viewable in compare view

Updates com.google.devtools.ksp from 2.3.11 to 2.3.12

Release notes

Sourced from com.google.devtools.ksp's releases.

2.3.12

What's Changed

Migrating Processors to Support Backing Fields

This release introduces support for explicit backing fields (#2873 ), which may now be returned by Resolver.getSymbolsWithAnnotation. To prevent breaking existing processors, new language features require an explicit opt-in.

Processors adapting to new features must opt in via both of the following steps simultaneously (failing to do both may lead to undefined behavior):

  1. The processor should call the registerProcessorForNewFeatures function in SymbolProcessorEnvironment immediately when created (and only once). Example: AbstractTestProcessor.kt#L30
  2. All implementations of KSVisitor should move to KSVisitorNext. If their processor code does not directly implement the interface but instead extends one of the KSP-provided visitors (such as KSTopDownVisitor), they should instead extend KSTopDownVisitor(enableNewFeatures = true) and override visitBackingField depending on their code and needs.

Bug Fixes

  • Fix Resolver.getDeclarationsFromPackage returning incomplete declarations from KLibs in Kotlin Multiplatform (#2396)
  • Fix KSP CLI process hanging indefinitely when a processor throws an unhandled exception (#3120)
  • Fix implicit task dependency error between KSP and Android Lint in Android KMP (#3128)
  • Fix NullPointerException by registering PluginProblemReporter as an application service (#3140)
  • Do not mark companion objects as JAVA_STATIC in Resolver.effectiveJavaModifiers (#3125)
  • Fix JAVA_STATIC modifier resolution for @​JvmStatic members in Resolver.effectiveJavaModifiers (#3124)
  • Update minimum supported Android Gradle Plugin (AGP) version to 8.12.0 (#3149)

New Contributors

Thanks to @​KlyneChrysler, @​budindepunk, and everyone who reported bugs and participated in discussions!

Full Changelog: google/ksp@2.3.11...2.3.12

Commits
  • a3c3859 Format Resolver file
  • a614317 Fix grammatical errors in Resolver doc comments
  • c19f255 Merge equal EXPECT NEXT and EXPECT CURRENT in javaBackingFieldUsedInKotlin
  • d3df886 Add test for getting default annotation values in KMP
  • 3bcac20 Mark testJavaBackingFieldUsedInKotlin as fixed
  • e74bb5f Update expected test output in libOrigins
  • c9b1d40 Use KSSyntheticJavaBackingFieldImpl in KSPropertyDeclarationImpl
  • afefe15 Add KSSyntheticJavaBackingFieldImpl
  • 2da07c1 Add test for missing synthetic Java fields
  • 7033530 Fix visibility modifiers for Kotlin-based backing fields
  • Additional commits viewable in compare view

Updates org.mongodb:mongodb-driver-kotlin-coroutine from 5.11.0 to 5.11.1

Release notes

Sourced from org.mongodb:mongodb-driver-kotlin-coroutine's releases.

Java Driver 5.11.1 (September 10, 2026)

What's Changed

[!WARNING] Starting from driver version 3.3.0, an improper neutralization of a query operator in the GridFS delete methods allowed unintended data deletion.

See JAVA-6283 / CVE-2026-88033]

Upgrade reactive/sync driver version to 5.11.1 or later.

If you cannot upgrade, applications using older driver versions should call another delete overload delete(ObjectId). The driver constructs the BsonObjectId internally from a typed value, so no document can reach the filter.

[!WARNING] Starting from driver version 4.2.0, cancelling or timing out an encrypted operation while the driver fetches cloud KMS credentials makes it call into freed native memory, crashing or corrupting the application.

See JAVA-6266 / CVE-2026-88032

Upgrade both reactive driver and mongodb-crypt to version 5.11.1 or later.

Full Changelog: mongodb/mongo-java-driver@r5.11.0...r5.11.1

Commits

Updates io.netty:netty-all from 4.2.17.Final to 4.2.18.Final

Release notes

Sourced from io.netty:netty-all's releases.

netty-4.2.18.Final

Security fixes

  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (SPDY)
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (HTTP/1.1)
  • CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-http2
  • CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp
  • CVE-2026-XXXXX : memory leak in io.netty:netty-codec-stomp
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3
  • CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-stomp
  • CVE-2026-XXXXX : parser desync/response smuggling in io.netty:netty-codec-memcache
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-smtp
  • CVE-2026-XXXXX : memory leak in io.netty:netty-codec-haproxy
  • CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (RTSP)
  • CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (HTTP/1)
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http (HTTP/1)
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3 and in io.netty:netty-codec-http2
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
  • CVE-2026-XXXXX : improper hostname verification in io.netty:netty-codec-classes-quic
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-redis
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http (HTTP/1.1)
  • CVE-2026-XXXXX : request smuggling vector in io.netty:netty-codec-http (HTTP/1.1)
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-mqtt
  • CVE-2026-XXXXX : improper CRLF neutralization in io.netty:netty-codec-smtp
  • CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2

Compatibility Notes

A number of security fixes have added additional validation and impose new resource usage limits, which may cause existing workloads to fail or be rejected. We recommend that you test your systems thoroughly as part of your Netty upgrade.

Two specific changes are worth calling out:

QUIC now explicitly requires X509ExtendedTrustManager when hostname verification is enabled. Previously, when configuring QUIC with an endpoint identification algorithm and an X509TrustManager, hostname verification would be silently skipped. This is now considered a misconfiguration and an exception will be thrown.

HTTP/2 header value validation is now enabled by default. HTTP/2 header name validation has always been enabled by default, with an option to disable it, but HTTP/2 header value validation has been disabled by default until now. Configuration options still exist to disable this, but validation of HTTP header names and values are now both opt-in by default rather than opt-out.

What's Changed

... (truncated)

Commits
  • 2521f49 [maven-release-plugin] prepare release netty-4.2.18.Final
  • 6fd5327 HTTP/1 absolute-form Host mismatch is translated to HTTP/3 :authority, overri...
  • c44a052 SPDY: SpdySessionHandler must limit the concurrent streams
  • 374d965 HTTP: Limit the maximum number of concurrent pipelined requests
  • 7e8b325 HTTP/2: Limit HPACK encoding table size
  • e3ebf70 OCSP: Correctly handle that nextUpdate is optional
  • 5388535 STOMP: Correctly release partial content on handler removal
  • 3a80f5a WebSockets: Enforce a limit for the max pipelined requests in WebSocketServer...
  • 1b6ea48 HTTP3: Correctly handle ":authority" and "host" headers
  • 3630659 STOMP codec content-length long-to-int truncation causes infinite decode loop...
  • Additional commits viewable in compare view

Updates io.netty:netty-transport-native-kqueue from 4.2.17.Final to 4.2.18.Final

Release notes

Sourced from io.netty:netty-transport-native-kqueue's releases.

netty-4.2.18.Final

Security fixes

  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (SPDY)
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (HTTP/1.1)
  • CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-http2
  • CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp
  • CVE-2026-XXXXX : memory leak in io.netty:netty-codec-stomp
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3
  • CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-stomp
  • CVE-2026-XXXXX : parser desync/response smuggling in io.netty:netty-codec-memcache
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3

@dependabot
Bump the all group with 14 updates
5cb0176 
Bumps the all group with 14 updates:

| Package | From | To |
| --- | --- | --- |
| [org.http4k:http4k-server-netty](https://github.com/http4k/http4k) | `6.58.0.0` | `6.59.0.0` |
| [com.squareup:kotlinpoet](https://github.com/square/kotlinpoet) | `2.3.0` | `2.4.0` |
| [com.squareup:kotlinpoet-ksp](https://github.com/square/kotlinpoet) | `2.3.0` | `2.4.0` |
| [com.google.devtools.ksp:symbol-processing-api](https://github.com/google/ksp) | `2.3.11` | `2.3.12` |
| [com.google.devtools.ksp](https://github.com/google/ksp) | `2.3.11` | `2.3.12` |
| [org.mongodb:mongodb-driver-kotlin-coroutine](https://github.com/mongodb/mongo-java-driver) | `5.11.0` | `5.11.1` |
| [io.netty:netty-all](https://github.com/netty/netty) | `4.2.17.Final` | `4.2.18.Final` |
| [io.netty:netty-transport-native-kqueue](https://github.com/netty/netty) | `4.2.17.Final` | `4.2.18.Final` |
| [io.netty:netty-transport-native-epoll](https://github.com/netty/netty) | `4.2.17.Final` | `4.2.18.Final` |
| [io.netty:netty-transport-native-io_uring](https://github.com/netty/netty) | `4.2.17.Final` | `4.2.18.Final` |
| org.slf4j:slf4j-api | `2.0.18` | `2.0.19` |
| [org.jetbrains.kotlin.jvm](https://github.com/JetBrains/kotlin) | `2.4.10` | `2.4.20` |
| [org.jetbrains.kotlin.multiplatform](https://github.com/JetBrains/kotlin) | `2.4.10` | `2.4.20` |
| [org.jetbrains.kotlin.plugin.serialization](https://github.com/JetBrains/kotlin) | `2.4.10` | `2.4.20` |


Updates `org.http4k:http4k-server-netty` from 6.58.0.0 to 6.59.0.0
- [Release notes](https://github.com/http4k/http4k/releases)
- [Changelog](https://github.com/http4k/http4k/blob/master/CHANGELOG.md)
- [Commits](http4k/http4k@6.58.0.0...6.59.0.0)

Updates `com.squareup:kotlinpoet` from 2.3.0 to 2.4.0
- [Release notes](https://github.com/square/kotlinpoet/releases)
- [Changelog](https://github.com/square/kotlinpoet/blob/main/docs/changelog.md)
- [Commits](square/kotlinpoet@2.3.0...2.4.0)

Updates `com.squareup:kotlinpoet-ksp` from 2.3.0 to 2.4.0
- [Release notes](https://github.com/square/kotlinpoet/releases)
- [Changelog](https://github.com/square/kotlinpoet/blob/main/docs/changelog.md)
- [Commits](square/kotlinpoet@2.3.0...2.4.0)

Updates `com.squareup:kotlinpoet-ksp` from 2.3.0 to 2.4.0
- [Release notes](https://github.com/square/kotlinpoet/releases)
- [Changelog](https://github.com/square/kotlinpoet/blob/main/docs/changelog.md)
- [Commits](square/kotlinpoet@2.3.0...2.4.0)

Updates `com.google.devtools.ksp:symbol-processing-api` from 2.3.11 to 2.3.12
- [Release notes](https://github.com/google/ksp/releases)
- [Commits](google/ksp@2.3.11...2.3.12)

Updates `com.google.devtools.ksp` from 2.3.11 to 2.3.12
- [Release notes](https://github.com/google/ksp/releases)
- [Commits](google/ksp@2.3.11...2.3.12)

Updates `org.mongodb:mongodb-driver-kotlin-coroutine` from 5.11.0 to 5.11.1
- [Release notes](https://github.com/mongodb/mongo-java-driver/releases)
- [Commits](mongodb/mongo-java-driver@r5.11.0...r5.11.1)

Updates `io.netty:netty-all` from 4.2.17.Final to 4.2.18.Final
- [Release notes](https://github.com/netty/netty/releases)
- [Commits](netty/netty@netty-4.2.17.Final...netty-4.2.18.Final)

Updates `io.netty:netty-transport-native-kqueue` from 4.2.17.Final to 4.2.18.Final
- [Release notes](https://github.com/netty/netty/releases)
- [Commits](netty/netty@netty-4.2.17.Final...netty-4.2.18.Final)

Updates `io.netty:netty-transport-native-epoll` from 4.2.17.Final to 4.2.18.Final
- [Release notes](https://github.com/netty/netty/releases)
- [Commits](netty/netty@netty-4.2.17.Final...netty-4.2.18.Final)

Updates `io.netty:netty-transport-native-io_uring` from 4.2.17.Final to 4.2.18.Final
- [Release notes](https://github.com/netty/netty/releases)
- [Commits](netty/netty@netty-4.2.17.Final...netty-4.2.18.Final)

Updates `io.netty:netty-transport-native-kqueue` from 4.2.17.Final to 4.2.18.Final
- [Release notes](https://github.com/netty/netty/releases)
- [Commits](netty/netty@netty-4.2.17.Final...netty-4.2.18.Final)

Updates `io.netty:netty-transport-native-epoll` from 4.2.17.Final to 4.2.18.Final
- [Release notes](https://github.com/netty/netty/releases)
- [Commits](netty/netty@netty-4.2.17.Final...netty-4.2.18.Final)

Updates `io.netty:netty-transport-native-io_uring` from 4.2.17.Final to 4.2.18.Final
- [Release notes](https://github.com/netty/netty/releases)
- [Commits](netty/netty@netty-4.2.17.Final...netty-4.2.18.Final)

Updates `org.slf4j:slf4j-api` from 2.0.18 to 2.0.19

Updates `org.jetbrains.kotlin.jvm` from 2.4.10 to 2.4.20
- [Release notes](https://github.com/JetBrains/kotlin/releases)
- [Changelog](https://github.com/JetBrains/kotlin/blob/master/ChangeLog.md)
- [Commits](JetBrains/kotlin@v2.4.10...v2.4.20)

Updates `org.jetbrains.kotlin.multiplatform` from 2.4.10 to 2.4.20
- [Release notes](https://github.com/JetBrains/kotlin/releases)
- [Changelog](https://github.com/JetBrains/kotlin/blob/master/ChangeLog.md)
- [Commits](JetBrains/kotlin@v2.4.10...v2.4.20)

Updates `org.jetbrains.kotlin.plugin.serialization` from 2.4.10 to 2.4.20
- [Release notes](https://github.com/JetBrains/kotlin/releases)
- [Changelog](https://github.com/JetBrains/kotlin/blob/master/ChangeLog.md)
- [Commits](JetBrains/kotlin@v2.4.10...v2.4.20)

Updates `org.jetbrains.kotlin.multiplatform` from 2.4.10 to 2.4.20
- [Release notes](https://github.com/JetBrains/kotlin/releases)
- [Changelog](https://github.com/JetBrains/kotlin/blob/master/ChangeLog.md)
- [Commits](JetBrains/kotlin@v2.4.10...v2.4.20)

Updates `org.jetbrains.kotlin.plugin.serialization` from 2.4.10 to 2.4.20
- [Release notes](https://github.com/JetBrains/kotlin/releases)
- [Changelog](https://github.com/JetBrains/kotlin/blob/master/ChangeLog.md)
- [Commits](JetBrains/kotlin@v2.4.10...v2.4.20)

Updates `com.google.devtools.ksp` from 2.3.11 to 2.3.12
- [Release notes](https://github.com/google/ksp/releases)
- [Commits](google/ksp@2.3.11...2.3.12)

---
updated-dependencies:
- dependency-name: org.http4k:http4k-server-netty
  dependency-version: 6.59.0.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: com.squareup:kotlinpoet
  dependency-version: 2.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: com.squareup:kotlinpoet-ksp
  dependency-version: 2.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: com.squareup:kotlinpoet-ksp
  dependency-version: 2.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: com.google.devtools.ksp:symbol-processing-api
  dependency-version: 2.3.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: com.google.devtools.ksp
  dependency-version: 2.3.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: org.mongodb:mongodb-driver-kotlin-coroutine
  dependency-version: 5.11.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: io.netty:netty-all
  dependency-version: 4.2.18.Final
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: io.netty:netty-transport-native-kqueue
  dependency-version: 4.2.18.Final
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: io.netty:netty-transport-native-epoll
  dependency-version: 4.2.18.Final
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: io.netty:netty-transport-native-io_uring
  dependency-version: 4.2.18.Final
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: io.netty:netty-transport-native-kqueue
  dependency-version: 4.2.18.Final
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: io.netty:netty-transport-native-epoll
  dependency-version: 4.2.18.Final
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: io.netty:netty-transport-native-io_uring
  dependency-version: 4.2.18.Final
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: org.slf4j:slf4j-api
  dependency-version: 2.0.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: org.jetbrains.kotlin.jvm
  dependency-version: 2.4.20
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: org.jetbrains.kotlin.multiplatform
  dependency-version: 2.4.20
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: org.jetbrains.kotlin.plugin.serialization
  dependency-version: 2.4.20
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: org.jetbrains.kotlin.multiplatform
  dependency-version: 2.4.20
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: org.jetbrains.kotlin.plugin.serialization
  dependency-version: 2.4.20
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: com.google.devtools.ksp
  dependency-version: 2.3.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Sep 13, 2026
@IRus @claude
Adapt to KSP 2.3.12 and Kotlin 2.4.20 deprecations
b74d0e4 
Move KomokEzVisitor to KSVisitorNext, pass enableNewFeatures=false to
KSNode.validate, refresh the api-dsl ABI dump and the Kotlin/JS yarn lock.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@IRus
IRus merged commit 5801968 into main Sep 13, 2026
7 checks passed
@dependabot
dependabot Bot deleted the dependabot/gradle/all-b0e577d11b branch September 13, 2026 20:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update Java code

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@IRus