fix(deps): update dependency io.ktor:ktor-client-cio to v3.6.0

bullshitrequested to merge
renovate/ktor-monorepo into main

This MR contains the following updates:

Package Change Age Confidence
io.ktor:ktor-client-cio 3.1.3 → 3.6.0 age confidence

⚠️ Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

ktorio/ktor (io.ktor:ktor-client-cio)

v3.6.0

Compare Source

Published 16 September 2026

Features
  • KTOR-8596 OpenID Connect (OAuth2) auto-discover & configuration
  • KTOR-9645 Client curated multi-platform facade module
  • KTOR-8883 Support nested jars in static resources
  • KTOR-8672 Support at least zstd and deflate formats of precompressed files
  • KTOR-8595 Auth JWK Support (auto-discover)
  • KTOR-9841 OIDC Server Plugin
  • KTOR-9654 Override fetch in JS engine
  • KTOR-9785 Typesafe Authentication DSL
  • KTOR-462 Async CIO DNS resolver with timeout
  • KTOR-9709 Add resource attribute for client resources plugin
  • KTOR-5009 ContentNegotiation: Add a way to prevent changing Accept and Content-Type headers
  • KTOR-9776 OpenAPI: Support the "const" validation keyword
  • KTOR-7468 DefaultConversionService: Support Uuid type introduced in Kotlin 2.0
  • KTOR-9578 HttpCache add method for clearing
  • KTOR-9590 OpenAPI Contextual JSON schema inference support
  • KTOR-6610 Log which ConfigLoader has been used for loading the server configuration
  • KTOR-9735 Commonize HttpCache FileCacheStorage
  • KTOR-8953 WebRTC client on JVM
  • KTOR-9674 UDP support for Node.js targets
  • KTOR-9612 Add text/markdown to the ContentType constants
Improvements
  • KTOR-9876 Typo in KDoc for routing function: "for the this Application".
  • KTOR-9778 Character classification in ktor-http hot paths uses boxed Set lookups and per-symbol encoder allocations
  • KTOR-9702 Duplicate code in ByteReadChannel
  • KTOR-9716 Make ApplicationCallPipeline.ApplicationPhase.Validators public in 3.6.0
  • KTOR-9734 Use TagConsumer in respondHtmlFragment lambda receiver
  • KTOR-5577 Support nullable types in ApplicationCall.receive
  • KTOR-2367 OAuth: clients expect to get authenticated once per "session" for all protected routes
  • KTOR-8594 Auth: Non-optional principal is of nullable type
  • KTOR-9816 Escape $ in application.yaml file
  • KTOR-8193 Unnecessary blocking in OutputStream wrapper
Bugfixes
  • KTOR-8705 testApplication: call coroutine context isn't preserved when responding with ChannelWriterContent
  • KTOR-9248 JWTAuthenticationProvider silently swallows exceptions
  • KTOR-9892 Digest Auth client: nc and qop are not handled according to RFC 7616
  • KTOR-9891 CIO on Kotlin/Native collapses above ~50 connections: HttpHeadersMap pools contend on an allocating SynchronizedObject
  • KTOR-9794 Digest Auth: NullPointerException when the server does not expect Digest auth
  • KTOR-9788 Netty: engine double-responds after its built-in 400, crashing the call-handler coroutine with "Headers can no longer be set because response was already completed"
  • KTOR-9834 HttpClient eagerly initializes SLF4J during Android startup
  • KTOR-9701 Jackson/Gson converters waste time on unnecessary Dispatchers.IO dispatch
  • KTOR-9832 Apache5: Upgrading Apache HttpClient5 to version 5.6 breaks the Ktor client with Content-Length mismatch error for any gzipped content
  • KTOR-9870 OkHttp: Reduce coroutine dispatching and allocations while reading response bodies
  • KTOR-9627 Cancel blocking bridges when coroutine is cancelled
  • KTOR-7067 Ktor Cookie.parseClientCookiesHeader returns Map, which breaks Cookie header contract
  • KTOR-9643 Allow H2C and HTTP/2 on same server
  • KTOR-9302 OpenAPI: No way to set tag description
  • KTOR-9827 Authorization header removed from refresh token request
  • KTOR-8355 Bad percentage encoding in URL query causes uncaught exception and 500 status
  • KTOR-9762 Android: can hang when cancelling a streaming response during a blocking read
  • KTOR-9443 OpenAPI: "No mapping for symbol: VALUE_PARAMETER" exception when respondText receives a conditional ContentType within ApplicationCall extension function
  • KTOR-9392 OpenAPI: "No mapping for symbol: VAR name" exception when code inference is on
  • KTOR-9389 OpenAPI: "IllegalStateException: No mapping for symbol" when code inference and passing received body to HttpStatusCode()
  • KTOR-9784 Multipart is not supported on non-JVM server targets
  • KTOR-9657 OpenAPI: generated schema for recursive types uses invalid schemaRef with ReflectionJsonSchemaInference
  • KTOR-9676 Incorrect warning about streaming compression buffering
  • KTOR-9712 Netty HTTP/3: the listener can only ever serve ONE QUIC connection — every subsequent handshake times out
  • KTOR-9386 Misleading log output for Unix Domain Socket servers: "Responding at unix://0.0.0.0:80"
  • KTOR-8755 CIO: The engine doesn't encode Unicode symbols like '–' (U+2013) in request URL
  • KTOR-9513 CharsetDecoder.decode() ignores the max argument on JVM
  • KTOR-9825 Unescape quoted-pair at the end of a header parameter value
  • KTOR-9731 CIO: HttpRequestLifecycle cancels Connection: close call too soon, sending an incomplete response
  • KTOR-9770 CIO: mapToKtor unwraps non-timeout exceptions to their cause
  • KTOR-9772 Make quality parameter case-insensitive
  • KTOR-9773 OkHttp: Cancelling a request can close the response body on the Android main thread
  • KTOR-7009 CIO: "Failed to parse HTTP response: unexpected EOF" when pipelining is on
  • KTOR-9819 Curl: Requests leak curl_slist and response StableRef
  • KTOR-9761 CIO server: request handler can leak when idle timeout cancels a claimed response
  • KTOR-9817 Darwin CertificatePinner over-releases borrowed Core Foundation references
  • KTOR-9774 CIO: pipelining corrupts requests with non-empty bodies
  • KTOR-9766 OpenAPI: "has no continuation" AssertionError when a suspend call inside a sealed-type branch reads the smart-cast value
  • KTOR-9775 OkHttp: duplex streaming does not release the connection after the request completes
  • KTOR-9722 DigestAuthProvider cannot be initialized with a congested Dispatchers.Default pool
  • KTOR-9739 Outdated KDoc for AuthProvider.refreshToken method
  • KTOR-9792 Application lifecycle events affect other reload generations
  • KTOR-9793 The new DI scope is cancelled during hot reload
  • KTOR-9648 OpenAPI: reflection schema inference produces incorrect discriminator mapping for Jackson-annotated and nested sealed hierarchies
  • KTOR-9760 Digest Auth: URI and HA2 are empty for a URL without a path
  • KTOR-9705 OpenAPI UI (ktor-server-openapi) does not support OpenAPI spec 3.1.*
  • KTOR-9715 Netty HTTP/3: user handler code is dispatched on the QUIC event loop — one blocking handler freezes the entire HTTP/3 listener (callEventGroup / pinnedCallExecutor not used)
  • KTOR-2912 CORS Plugin: Access-Control-Allow-Methods header does not include default methods (GET, POST, HEAD)
  • KTOR-9526 Static Content: excluded extension prevents fallback, and index file bypasses exclusion rules
  • KTOR-9523 OAuth2: fallback handler not invoked when token endpoint returns invalid_grant
  • KTOR-9501 Websockets: Closing WebSocketSession with a long message leads to ProtocolViolationException
  • KTOR-9561 ByteReadChannel.copyTo does not propagate source closedCause on normal exit
  • KTOR-9640 ktor-io reader/writer ignores autoFlush
  • KTOR-9889 DI: Concurrent module loading can cause a deadlock
  • KTOR-9886 Netty: inverted skippedRead CAS leaves runningLimit read-resumption broken; runningLimit = 1 deadlocks keep-alive connections

v3.5.2

Compare Source

Published 31 July 2026

Improvements
  • KTOR-8032 RateLimit: Allow limit requests based on authentication result
  • KTOR-9719 ApplicationCall.isStaticContent returns false when called from plugin interceptors
  • KTOR-8450 ContentNegotiation: it doesn't handle content type suffixes
  • KTOR-7892 SwaggerUI: Missing oauth2-redirect.html support in the plugin
  • KTOR-9759 Reject whitespace in URL hosts during parsing
  • KTOR-9681 Update kotlinx-io to 0.9.1
  • KTOR-9743 ByteReadChannel.readLineStrict: Misleading definition of limit parameter in KDocs
  • KTOR-9504 Improve KDoc for EmbeddedServer.addShutdownHook
Bugfixes
  • KTOR-9741 CIO: request-handler coroutine leak on half-closed idle connection after ≥1MB response
  • KTOR-7661 Maven + YAML config file does not work
  • KTOR-9585 OpenAPI: JsonSchema title is truncated when it contains a dot
  • KTOR-9704 UTF-8 encoding in ktor-io bypasses JVM String.getBytes intrinsics, slowing every text response by 5-7x
  • KTOR-9588 SSE client (CIO engine) sends spurious Content-Length: 0 on body-less GET (RFC 9110 § 8.6 violation; rejected by AWS ELB)
  • KTOR-9679 ByteReadChannel.readLine corrupts multi-byte UTF-8 by splitting a character at a buffer boundary
  • KTOR-9767 ByteReadChannel.readLineTo: Return read bytes count instead of decoded characters count
  • KTOR-8992 HoconConfigLoader is not loaded when ktor-server-config-yaml on the classpath
  • KTOR-9698 OpenAPI: schema for kotlinx.serialization sealed types omits discriminator property in variant schemas
  • KTOR-9690 Netty: in-flight requests are aborted on stop(), ignoring shutdown grace period
  • KTOR-8903 Netty: Close channel connection on errors properly
  • KTOR-9707 SaveBody performance regression
  • KTOR-9703 Inefficient text reading function in DefaultTransform
  • KTOR-9711 Netty HTTP/2: a single client-canceled stream (RST_STREAM) breaks response flushing for the whole connection
  • KTOR-9688 RateLimit: No access to principal when wrapped with authentication since 3.5.1
  • KTOR-9677 Auto-reloading: server is reloaded only once since 3.5.0
  • KTOR-9683 Sockets: Canceling a SelectorManager job doesn't close it properly
  • KTOR-9671 Darwin: Semicolons in URL path are sanitized

v3.5.1

Compare Source

Published 25 June 2026

Improvements
  • KTOR-9492 OpenAPI plugin: handle requireXxx functions in compiler plugin
  • KTOR-9569 Add more details for KDoc of BearerAuthConfig.sendWithoutRequest
  • KTOR-9571 Add KDoc for BearerAuthConfig.realm
  • KTOR-9570 Add Kdoc for BearerAuthConfig.refreshTokens
Bugfixes
  • KTOR-9646 Fix Kotlin 2.4.0 compiler plugin breaking changes
  • KTOR-9585 OpenAPI: JsonSchema title is truncated when it contains a dot
  • KTOR-9591 OpenAPI: @JsonClassDiscriminator on sealed types is ignored when generating OpenAPI discriminator schema
  • KTOR-9597 OpenAPI: Schema name collisions because@SerialName of sealed subtypes is used as components.schemas key
  • KTOR-9601 OpenAPI: nullable @​JvmInline value class loses nullability in generated schema
  • KTOR-9620 Some issues related to digest authentication in 3.5.0
  • KTOR-9623 Digest Auth: server must respond with one WWW-Authenticate header for each supported algorithm
  • KTOR-9624 Digest Auth: "Unsupported charset in digest authentication header" for a charset name in lowercase
  • KTOR-9630 Digest Auth: The plugin sends incorrect nonce when server responds with multiple WWW-Authenticate headers
  • KTOR-9565 WebRTC: Peer stops receiving messages after a while on iOS
  • KTOR-9610 WebRtcPeerConnection::close causes ClosedReceiveChannelException for other peer
  • KTOR-9633 WebRTC statistics fetching race condition
  • KTOR-9603 Structured concurrency is violated in WebRTC tests
  • KTOR-9671 Darwin: Semicolons in URL path are sanitized
  • KTOR-9639 Darwin: WebSocket client crashes the process when a PONG arrives after the session is closed
  • KTOR-9575 Darwin: findCharset("UTF-16") maps to NSUTF16LittleEndianStringEncoding causing decoding failure for UTF-16 content with BOM
  • KTOR-9661 HttpCache: InvalidCacheStateException is thrown on 304 when no cached entry matches varyKeys
  • KTOR-9673 Caching always missing with Content Negotiation
  • KTOR-9596 HttpTimeout: HttpRequestTimeoutException on any request with runTest and request timeout defined since 3.5.0
  • KTOR-9632 HttpRequestBuilder.timeout call removes capabilities set in DefaultRequest
  • KTOR-9252 ContentEncoding: Incomplete gzip response causes client/server to hang indefinitely
  • KTOR-9670 Compression: The plugin ignores Accept-Encoding q=0 and most-specific matching
  • KTOR-9614 Zstd Compression: "Destination buffer is too small" exception for a particular sequence of bytes
  • KTOR-9636 CORS plugin drops OPTIONS preflight requests when allowSameOrigin is on
  • KTOR-9659 CORS is skipped when the Origin header contains an IPv6 address
  • KTOR-9574 ContentNegotiation: The charset of Accept-Charset header is used for response deserialization
  • KTOR-9606 KotlinxSerializationConverter: it fails to deserialize an empty channel closed with a delay
  • KTOR-9617 OutputStreamContent and WriterContent can exhaust Dispatchers.IO
  • KTOR-9629 RawSourceChannel: coroutine cancellation is not propagated to the RawSource
  • KTOR-8870 File.readChannel: do not close a non-opened file and ignore closing exceptions
  • KTOR-9460 Curl: Can't build shared library with Ktor 3.4.2
  • KTOR-9607 Crash on Android 7: NoSuchMethodError getInstanceStrong() since 3.5.0
  • KTOR-9595 CIO: The engine imports node:net statically and breaks wasmJsBrowser webpack build
  • KTOR-9615 Apache5: The underlying request is not aborted when coroutine Job is cancelled
  • KTOR-8443 RoutingBuilder.contentType does not use parameters when matching
  • KTOR-9425 SessionTransportTransformerEncrypt init block uses wrong IV size for AES-256 (regression of KTOR-661)
  • KTOR-9621 RateLimit plugin is bypassed when the nested authenticate block rejects the request
  • KTOR-8766 DI: The close method is called twice on cleanup of AutoCloseable
  • KTOR-8695 GMTDate() being offset by 369 years on Windows
  • KTOR-9589 Duplicate PROPERTY_SETTER target in @​InternalAPI annotation
  • KTOR-9602 Gradle plugin environment variable is not included in the image

v3.5.0

Compare Source

Published 14 May 2026

Features
  • KTOR-8421 Route.contentType should support multiple ContentType
  • KTOR-7961 Add known TDM headers to the HttpHeaders object
  • KTOR-9418 Support getAs from the root ApplicationConfig
  • KTOR-9559 DNS configuration for the Apache5 client
  • KTOR-9554 DNS configuration for OkHttp client engine
  • KTOR-9555 Custom SSE heartbeat function
  • KTOR-8914 Dependency injection: read annotations in function references
  • KTOR-8300 Sessions: Add a way to create a user session shared for all user devices or look up sessions of the same user
  • KTOR-9521 Upgrade to Kotlin 2.3.21
  • KTOR-9276 Make DynamicProviderConfig.authenticateFunction suspend
  • KTOR-9491 Provide parameter validation convenience functions
  • KTOR-9506 OpenAPI: Support prefixItems in JsonSchema for tuple type definitions
  • KTOR-470 Add an option to not resend the session cookie if the session data wasn't changed.
  • KTOR-9355 Deprecate HttpHeaders.AcceptCharset
  • KTOR-7659 Make ktor-network compatible with ES modules for nodejs
  • KTOR-9350 JS: Make ES2015 the default target for tests
  • KTOR-7578 Update Digest authentication implementation according to RFC 7616
Improvements
  • KTOR-9503 The JacksonConverter.streamRequestBody property name is confusing
  • KTOR-9552 Deprecation notice for io.ktor.server.auth.Principal does not explain what to use instead
  • KTOR-7458 Jetty Jakarta: Provide an easy way to disable SNI hostname validation
  • KTOR-9354 Websockets: webSocket builder function should return a Route to be describable
  • KTOR-9488 Nonce and hex function performance optimizations
Bugfixes
  • KTOR-9524 Netty response hangs after connection lost
  • KTOR-9542 Netty: The request handler runs on worker event loop instead of call event loop since 3.4.3
  • KTOR-9531 Netty server intermittently drops requests after upgrading to 3.4.3
  • KTOR-8151 MicrometerMetrics: "MeterFilters configured after a Meter has been registered" warning when a metric is registered before installing the plugin
  • KTOR-9411 Darwin throws DarwinHttpRequestException instead of FrameTooBigException
  • KTOR-8320 CallLogging: plugin usage in testApplication breaks console standard output
  • KTOR-8906 Jackson, with request body streaming on, exhausts Dispatchers.IO
  • KTOR-8709 Websockets: Unable to close session with a custom CloseReason
  • KTOR-9567 Flaky UnixSockets on Windows: WSAEOPNOTSUPP from bind()
  • KTOR-9183 A client call wrapped with withTimeout throws a generic CancellationException instead of TimeoutCancellationException
  • KTOR-8199 Autoreloading: default watch patterns don't match anything when project path contain spaces
  • KTOR-9549 Kotlin/JS: ktor-ktor-client-core.mjs is incompatible with Vite: toRaw naming conflict
  • KTOR-9544 Apache: body channel not cancelled when caller scope is cancelled
  • KTOR-9546 HttpClient: cancelling ByteReadChannel body does not propagate to engine
  • KTOR-455 Content-Disposition additional parameters should be inside quotes
  • KTOR-9500 RawSourceChannel returns false positive on awaitContent
  • KTOR-646 Netty engine still print annoying exceptions
  • KTOR-9527 Curl: Freeze when receiving large responses
  • KTOR-9460 Curl: Can't build shared library with Ktor 3.4.2
  • KTOR-9483 Curl: backpressure implementation is never used
  • KTOR-9545 Curl: body channel not cancelled when caller scope is cancelled
  • KTOR-9540 Curl: CancelWebSocket task may cancel a new HTTP request due to easy handle pointer reuse
  • KTOR-9539 Curl: WebSocket bearer token refresh fails due to stale native handle reuse
  • KTOR-9536 Netty call hang when channel becomes inactive before response is sent
  • KTOR-4752 OkHttp: Websockets pinging doesn't work
  • KTOR-9409 call.respond performance regression caused by transitive kotlin-reflect:2.3.0
  • KTOR-9487 ZSTD decoder fails if the compressed frame is larger than 4096 bytes
  • KTOR-8271 MockEngine, HttpTimeout: the virtual clock of kotlinx coroutines isn't respected
  • KTOR-6683 Plugin onCallReceive/transformBody is not called for receive()
  • KTOR-7416 Jetty, Java: Custom Host header doesn't override the default value
  • KTOR-9203 CIOMultipartDataBase: Call thread is blocked when releasing file parts

v3.4.3

Compare Source

Published 22 April 2026

Bugfixes
  • KTOR-9451 OpenAPI schema inference not working for custom nested generics
  • KTOR-9490 OpenAPI: Self-referential schema $ref uses FQN while schema is registered with a simple name
  • KTOR-9463 OpenAPI: schema inference StackOverflow
  • KTOR-8938 WebSockets: WebSockets handler does not inherit server coroutine context
  • KTOR-8989 Shared engine is closed when a client created with config method is closed
  • KTOR-9485 Apache5: FutureCallback never called, breaking Java agent instrumentation
  • KTOR-9497 Darwin: SIGABRT crash when close() races with in-flight execute() since 3.4.2
  • KTOR-9431 SuspendFunctionGun: ThreadContextElement leaks across requests when interceptor suspends
  • KTOR-9423 CannotTransformContentToTypeException leaks internal class names in response body
  • KTOR-9461 Incorrect link to the OWASP cheatsheet in the KDoc for CSRF plugin
  • KTOR-9476 Unable to update/remove session data if no response content
  • KTOR-9343 HttpRequestLifecycle plugin with cancelCallOnClose on, cancels subsequent requests when CallLogging plugin with callIdMdc is installed

v3.4.2

Compare Source

Published 27 March 2026

Improvements
  • KTOR-9327 Curl: The WebSockets maxFrameSize option does not have an effect
  • KTOR-9383 CaseInsensitiveString: reduce allocations
  • KTOR-9385 Netty: Allocation micro-optimizations
  • KTOR-9403 Darwin: Unnecessary ByteArray copy for each received response chunk
  • KTOR-9412 KDoc for formFieldLimit documents incorrect default value (64 KB instead of 50 MiB)
Bugfixes
  • KTOR-9351 OpenAPI: Incorrect schema generated for nested classes with lists
  • KTOR-9361 WebSockets: JsWebSocketSession._closeReason is completed twice
  • KTOR-9437 Fix GraalVM Compatibility
  • KTOR-9424 Logging: OkHttp format should log the full requested URL
  • KTOR-8540 Logging: IllegalStateException is thrown when response is cached and deserialization fails
  • KTOR-9370 OpenAPI: NoSuchMethodError - getLOCAL_FUNCTION_FOR_LAMBDA with Kotlin 2.3.20-*
  • KTOR-9421 Netty: active SSE connection blocks HTTP/2 response flushing for other requests
  • KTOR-3390 JS browser: "Failed to execute 'digest' on 'SubtleCrypto'" error when using digest auth
  • KTOR-5977 Compression: The encoders buffer streaming response
  • KTOR-9393 Certificate pinning matches against all pins instead of hostname-scoped pins
  • KTOR-8751 DI: AmbiguousDependencyException when named dependency is overridden in testApplication
  • KTOR-9039 Bearer Auth: Request body transformed with jsonIO isn't sent over again after refreshToken request
  • KTOR-9404 Darwin: Memory leak in KtorNSURLSessionDelegate
  • KTOR-9399 LinkageError when running Ktor app with development mode inside Spring Boot / Amper fat-JAR
  • KTOR-9402 NoSuchMethodError on RawWebSocket after 3.4.0
  • KTOR-9372 Frame.Text.readText() causes infinite loop and 100% CPU on Kotlin/Native when WebSocket frame data is malformed or connection drops unexpectedly
  • KTOR-9387 ZstdEncoder decode fails when source data is split into multiple Zstd frames

v3.4.1

Compare Source

Published 3 March 2026

Improvements
  • KTOR-9382 HttpProtocolVersion.parse: fast path for common versions
  • KTOR-9381 GMTDate: reduce allocations
  • KTOR-8971 Support "operationId" in Kdoc for OpenAPI spec. gen.
  • KTOR-9333 WebSockets: Infinite spin and potential OOM vulnerabilities in the Inflater.inflateFully method
  • KTOR-5616 Ktor always adds by default an Accept-Charset header
  • KTOR-9291 OpenAPI: handle atypical route functions
  • KTOR-9293 OpenAPI describe needs defaults
  • KTOR-9304 OpenAPI: Order of path parameters is not preserved in the spec
  • KTOR-9353 Routing: TailcardSelector missing toString(), which clutters the logs
Bugfixes
  • KTOR-9281 OpenApi code inference misses lambda argument bodies
  • KTOR-9273 OpenAPI static content path appears in resulting model
  • KTOR-9004 OpenAPI: No respective formats detected for serializable types like UUID or Instant
  • KTOR-9305 OpenAPI: "No mapping for symbol: VAR FOR_LOOP_VARIABLE" error with codeInferenceEnabled=true
  • KTOR-9279 OpenAPI: UnsupportedOperationException for a function with a reified type parameter codeInferenceEnabled = true
  • KTOR-9289 OpenAPI: Resource routes are missing inferred and comment-based documentation
  • KTOR-9330 OpenAPI: Cannot override kotlinx.serialization module
  • KTOR-9320 OpenAPI: jsonSchema() does not unwrap Kotlin value classes (inline classes)
  • KTOR-9352 Authentication: Creating JWT verifier fails for JWK with kty=EC and alg=null
  • KTOR-9344 Flow invariant error happens after update to Ktor 3.4.0
  • KTOR-9362 testApplication: Race condition in timeout coroutine when response is streaming
  • KTOR-9274 Curl: Undefined symbol errors when linking on Linux since 3.4.0
  • KTOR-8782 NodeJS CIO: "Module 'os' could not be imported" error on resolving WORKING_DIRECTORY_PATH with es2015 target
  • KTOR-9348 String.decodeBase64String fails to decode when the input has no padding since 3.4.0
  • KTOR-9318 CIO engine rejects valid certificates with unsupported signature algorithms
  • KTOR-9331 Curl: Segfaults when working with WebSockets
  • KTOR-9334 Coroutines in route handlers are dispatched with Dispatchers.Unconfined since 3.2.0
  • KTOR-9339 StreamResetException is not propagated to the caller of StreamRequestBody.writeTo since 3.4.0
  • KTOR-9329 HTMX: "on" attributes extension not working
  • KTOR-9316 WasmJS bad get and set implementations for Uint8Array and ArrayLike
  • KTOR-9272 JSON schema inference does not recognize unsigned types
  • KTOR-9211 SendCountExceedException when request is sent twice with maxRetries = 0 since 3.3.2
  • KTOR-9285 RateLimit: Milliseconds in the Retry-After header are truncated
  • KTOR-7512 JWT: Docs for validate method claim that it's optional, but it isn't
  • KTOR-9269 Incorrect dependency declaration in swagger / openapi
  • KTOR-9372 Frame.Text.readText() causes infinite loop and 100% CPU on Kotlin/Native when WebSocket frame data is malformed or connection drops unexpectedly

v3.4.0

Compare Source

Published 22 January 2026

Features
  • KTOR-8316 Support OpenAPI specification for the Ktor Client and Server Application
    • KTOR-9085 Read OpenAPI security details from authentication plugin
    • KTOR-8993 Use runtime-generated spec for OpenAPI / Swagger plugins
    • KTOR-9086 Read OpenAPI default content type information from ContentNegotiation plugin
    • KTOR-8859 Routing documentation compiler plugin
    • KTOR-8936 Routing documentation runtime API
    • KTOR-9087 Generate JSON schema for type references when using Jackson and Gson
  • KTOR-7075 Zstd support
  • KTOR-9209 Support Jackson 3
  • KTOR-9198 Auth/Bearer: Make BearerAuthProvider detect disguised Bearer scheme
  • KTOR-8927 Support for respondResource
  • KTOR-9162 Auth API key plugin
  • KTOR-7882 Support HTTP QUERY method
  • KTOR-8195 Partial HTML response
  • KTOR-8985 EngineMain: Support reading trust store settings from the configuration
  • KTOR-9066 Add duplex streaming for OkHttpClient
  • KTOR-8180 Auth: Provide control over tokens to user code
  • KTOR-8273 iOS native interop for WebRTC client
  • KTOR-8956 DI: Allow file configuration
  • KTOR-9157 Support SIGINT on web and SIGTERM on Native
Improvements
  • KTOR-8890 Rename target jsAndWasmShared to web
  • KTOR-9242 Upgrade to Kotlin 2.3
  • KTOR-9243 Update libcurl to 8.18.0
  • KTOR-9014 Deprecate DarwinLegacy engine
  • KTOR-8931 Test iOS target of the WebRTC Client in Ktor-Chat
  • KTOR-9199 Make HttpHeaders strings const
  • KTOR-9208 Expose plusIsSpace in parseUrlEncodedParameters
  • KTOR-2404 Ktor Oauth2 feature sends 401 response when the client secret is invalid
  • KTOR-9097 Java: Use HTTP/2 by default
  • KTOR-8740 HTMX: Missing DSL for some attributes
  • KTOR-9171 Redesign ByteReadChannel.readUTF8Line API
  • KTOR-4219 Make readUTF8LineTo return number of read symbols instead of boolean
  • KTOR-6761 Apache5: Simplify configuration of ConnectionManager
  • KTOR-9037 Multipart/form-data: Make formData's block inline
  • KTOR-9126 Missing function ByteReadChannel.readTo(sink: RawSink, byteCount: Long)
  • KTOR-9026 Introduce/reuse interfaces for logging selectors
  • KTOR-6766 Deprecate Apache 4 engine
  • KTOR-8642 Excessive memory allocations while writing bytes into write channel of TCP/IP socket
  • KTOR-9137 ByteReadChannel.readUTF8Line is inefficient for long lines
  • KTOR-8657 Remove kotlinx-datetime from ktor-server-default-headers dependencies
  • KTOR-8941 Add override DI conflict policy
Bugfixes
  • KTOR-9258 headers { } block does not affect the request in defaultRequest due to function name collision with io.ktor.http.headers
  • KTOR-9235 HttpCookies: Support parsing non-compilant Expires dates of Set-Cookie header
  • KTOR-8945 ByteReadChannel.readUTF8Line doesn't throw TooLongLineException when the limit is reached
  • KTOR-8339 Curl: caPath is not set by default in the Curl client on linuxArm64
  • KTOR-9188 WebRTC. IceServer.urls should be a list.
  • KTOR-9148 Logging: Body logging of multipart/form-data requests hangs when OkHttp format is on
  • KTOR-9166 CORS: Excessive logs on INFO level since 3.3.3
  • KTOR-9130 Missing implementation of getPluginId method error with Kotlin 2.3.0-RC
  • KTOR-9147 OpenAPI: "AssertionError: Cannot add a performance measurements" leading to StackOverflowError within a multimodule project
  • KTOR-2162 JettyKtorHandler executor will never grow beyond core size
  • KTOR-9201 audio/x-matroska is wrongly recognized as mkv type
  • KTOR-9146 Run HttpStatement.execute on the engine's dispatcher
  • KTOR-6300 Native engines should use Dispatchers.IO not Dispatchers.Unconfined
  • KTOR-9098 Curl: HttpResponse.version always returns HTTP_1_1
  • KTOR-9100 Curl always uses HTTP/1.1
  • KTOR-7162 DefaultRequest: Configuration applied twice for client created with HttpClient.config
  • KTOR-9102 SSE: Java engine does not close the underlying connection when SSE session is canceled
  • KTOR-9108 SSE: The handler adds Connection: Keep-Alive header, which is incompatible with HTTP/2
  • KTOR-7884 Auth: The MutableList cannot be accessed since 3.0.0
  • KTOR-6569 Bearer auth: Don't cache client bearer token (option)
  • KTOR-4946 Auth: Bearer authentication - unable to update tokens
  • KTOR-4759 Auth: BearerAuthProvider caches result of loadToken until process death
  • KTOR-9129 Fix SendCountExceedException when maxRetries = Int.MAX_VALUE
  • KTOR-9113 Netty HTTP2 server hangs on the plugin exception
  • KTOR-9135 buildOpenApi fails with unknown serializer
  • KTOR-8285 Bearer Auth: request cancellation causes refresh token invalidation
  • KTOR-5241 The decodeBase64Bytes method doesn't throw an exception on illegal base64 characters
  • KTOR-8912 Incorrect KDoc of ApplicationConfig.tryGetStringList
  • KTOR-9079 The ktor-server-test-host module, having junit-jupiter runtime dependency, causes conflicts
  • KTOR-7713 HttpCallValidatorConfig.handleResponseException() should receive a CallExceptionHandler
  • KTOR-7121 testApplication: Test HTTP client does not use specified coroutine dispatcher
  • KTOR-8785 DI: JobCancellationException during cleanup
  • KTOR-6198 Client/WebSocket/Darwin close code and reason are incorrect
  • KTOR-7824 Ktor doesn't parse multiple headers

v3.3.3

Compare Source

Published 26 November 2025

Improvements
  • KTOR-6837 Discrepancies when parsing URL host with CIO and Darwin engines compared to the rest engines
  • KTOR-9050 Logging: SimpleLogger should be an object, not a class
  • KTOR-9094 Jetty Client: Support HTTP/2 over cleartext (h2c)
  • KTOR-9120 OpenAPI gen: missing operationId for KDoc fields
  • KTOR-3019 Improve logging for CORS plugin
Bugfixes
  • KTOR-8671 Netty: RejectedExecutionException during shutdown on MacOS when dev mode is enabled
  • KTOR-9096 Darwin: New SSE handlers stop responding after canceling few SSE sessions
  • KTOR-9125 Double ResponseSent invocation when exception is thrown after respond
  • KTOR-8878 OpenAPI: StackOverflowError when a response object has property with @​Contextual serializer
  • KTOR-8947 Java, ContentEncoding: IllegalHeaderNameException is thrown for ":status" pseudo header with HTTP/2
  • KTOR-9092 NettyHttp2Handler throws IllegalArgumentException: 'ktor.ApplicationCall' is already in use
  • KTOR-8924 Curl: Client sends both Transfer-Encoding and Content-Length headers for DELETE requests with body
  • KTOR-8838 Exception handling issue in client cache

v3.3.2

Compare Source

Published 5 November 2025

Improvements
  • WebRTC Client. Remove redundant targets (KTOR-9062)
  • Add Socks proxy support to Darwin engine (KTOR-8968)
  • Java: Improve error message when SOCKS proxy is used (KTOR-2908)
Bugfixes
  • HttpRequestRetry: SendCountExceedException when max retries is more than maxSendCount of HttpSend (KTOR-5850)
  • Darwin: The maxFrameSize option has no effect (KTOR-6963)
  • OpenAPI: StackOverflowError when a response object has property with @​Contextual serializer (KTOR-8878)
  • OpenAPI gen: missing KDoc fields (KTOR-9021)
  • Server call.request.path() returns routing selectors in path (KTOR-7639)
  • StaticContent doesn't allow siblings (KTOR-9012)
  • HttpCache: FileStorage doesn't use given dispatcher for all file operations (KTOR-8832)
  • Curl: SOCKS proxy doesn't work (KTOR-9008)
  • Netty: java.lang.VerifyError is thrown on Android since 3.3.0 (KTOR-8916)
  • Response body channel is canceled while the body is being saved when having HttpRequestRetry and onDownload (KTOR-8975)
  • HttpCache: InvalidCacheStateException when varyKeys stored in files contain uppercase letters since 3.3.0 (KTOR-8970)

v3.3.1

Compare Source

Published 8 October 2025

Improvements
  • Add a note about SSE session lifetime in KDoc (KTOR-8440)
  • Update Kotlin to 2.2.20 (KTOR-8896)
Bugfixes
  • NumberFormatException when Content-Length header value contains null bytes (KTOR-4828)
  • SerializationException: Serializer for class 'ClientSSESession' is not found when server responds with JSON (KTOR-7631)
  • Netty: loadConfiguration missing enableHttp2 and enableH2c properties (KTOR-8898)
  • Netty: EmbeddedServer.stop always blocks for twice of shutdownGracePeriod (KTOR-8770)
  • shutdownGracePeriod is used instead of shutdownTimeout in EmbeddedServer.stop() (KTOR-8771)
  • Support serving static resources within bootJar (KTOR-8592)

v3.3.0

Published 11 September 2025

Features
  • Support for server side http2 without tls (h2c) (KTOR-4750)
  • OpenAPI generation build extension preview (KTOR-8721)
  • Serve static resources with caching headers and ETag based on sha256 of content (KTOR-6700)
  • Jetty engine: Upgrade Jetty dependencies to the latest version 12 (KTOR-6734)
  • Static content: Support a custom respond logic if the file is not found (KTOR-8496)
  • Upgrade OkHttp to version 5.0.0 (KTOR-8652)
  • WebRTC Client, Android + WASM (KTOR-7958)
Improvements
  • SSE: Cannot read response body from SSEClientException (KTOR-8165)
  • SSE: "SSEClientException: Content-Length mismatch" on saving response body in DefaultResponseValidation (KTOR-8753)
  • var Route.staticRootFolder: File? should be deprecated (KTOR-5836)
  • Add image/bmp to the ContentType (KTOR-8735)
  • Add some missing image content types (KTOR-8624)
  • Upgrade to Kotlin 2.2 (KTOR-8647)
  • Bump Kotlin API level to 2.2 (KTOR-8637)
  • CIO: The engine ignores system proxy settings (KTOR-5922)
Bugfixes
  • Performance regression when using ContentEncoding and HttpRequestRetry since 3.2.0 (KTOR-8820)
  • Big number of simultaneous outbound web socket connections leads to a coroutine deadlock (KTOR-8829)
  • DI: JobCancellationException during cleanup (KTOR-8785)
  • Autoreloading: JobCancellationException when app is reloaded in the debugger since 3.2.0 (KTOR-8810)
  • HttpRedirect: The client is redirected when no Location header in response (KTOR-8697)
  • SerializationException when Application.propertyOrNull() is called with type Map<String, Any?> (KTOR-8781)
  • "Failed resolution of: Ljava/lang/management/ManagementFactory" on Android when JvmGcMetrics are initialized (KTOR-8714)
  • HttpCache: all header values but first in HttpResponse.varyKeys() are ignored (KTOR-6402)
  • HttpCache: plugin selects wrong cache entry when filtering Vary headers with different case (KTOR-7621)
  • CountedByteWriteChannel: autoFlush of the source channel doesn't make the channel auto flushing (KTOR-8411)

v3.2.3

Compare Source

Published 29 July 2025

Improvements
  • Server only accepts yaml as the configuration file suffix (KTOR-8712)
  • JS / WASM error when process global is undefined (KTOR-8686)
  • DI async duplicate resolution (KTOR-8681)
Bugfixes
  • CIO: Expect 100-continue response is missing a final \r\n (KTOR-8687)
  • Intermittent "ParserException: No colon in HTTP header" when parsing multipart request (KTOR-8523)
  • Infinite loop in ByteReadChannel.readFully (KTOR-8682)
  • ShutDownUrl: The server cannot shut down since 3.2.0 (KTOR-8674)

v3.2.2

Compare Source

Published 14 July 2025

Improvements
  • SSE: Change the order of SSE field serialization: put event before data (KTOR-8627)
Bugfixes
  • CORS: server replies with the 405 status code on a preflight request when the plugin is installed in a route (KTOR-4499)
  • Darwin: The Content-Encoding header is removed since 3.0.3 (KTOR-8526)
  • JS/WASM: response doesn't contain the Content-Length header in a browser (KTOR-8377)
  • StatusPages: response headers of OutgoingContent aren't available in the status handlers (KTOR-8232)
  • testApplication: The client.sse() acts like a REST call and not a stream in test environment (KTOR-7910)
  • Config deserialization - default properties problem (KTOR-8654)
  • kotlinx.datetime is not available transitively in 3.2.1 (KTOR-8656)
  • Request builder block overrides HTTP method in specific request builders (get, post, etc) (KTOR-8636)

v3.2.1

Compare Source

Published 3 July 2025

Improvements
  • Replace kotlinx.datetime APIs with kotlin.time (KTOR-8635)
  • Thymeleaf: null values in template model (KTOR-8559)
  • Publish Javadoc as a maven artifact (KTOR-3962)
  • Netty: Invalid hex byte with malformed query string (KTOR-2934)
Bugfixes
  • "Space characters in SimpleName" error when executing R8 mergeExtDex task with 3.2.0 (KTOR-8583)
  • ForwardedHeaders: the plugin does not handle parameters case-insensitively (KTOR-8622)
  • Potential race condition in socket.awaitClosed (hangs indefinitely) since 3.2.0 (KTOR-8618)
  • Module parameter type Application.() -> kotlin.Unit is not supported in 3.2.0 (KTOR-8602)
  • OkHttp: java.net.ProtocolException when sending MultiPartFormDataContent with onUpload (KTOR-6790)
  • OAuth2 authentication provider breaks form-urlencoded POST requests when receiving request body (KTOR-4420)
  • 404 for a link in KDoc for io.ktor.server.plugins.contentnegotiation.ContentNegotiation (KTOR-8597)
  • Ktor fails to boot with default jvminline argument (KTOR-8608)
  • Flow invariant is violated since 3.2.0 (KTOR-8606)
  • ResponseSent hook handler of the plugin installed into a route isn't executed when an exception is thrown from the route (KTOR-6794)

v3.2.0

Compare Source

Published 12 June 2025

Features
  • Dependency injection Ktor extension (KTOR-8267)
  • Support Version Catalog (KTOR-8162)
  • Unix domain socket support at the Ktor Engine level (KTOR-4766)
  • Allow suspend Ktor modules (KTOR-8005)
  • Ability to use browser cookie storage (KTOR-539)
  • Configuration file deserialization (KTOR-7874)
  • HttpCache: Support evicting/clearing cache (KTOR-6653)
  • File configuration for dependencies (KTOR-8304)
Improvements
  • Excessive allocation of ApplicationConfig when loading multiple files from CLI (KTOR-8563)
  • Linux curl engine doesn't work for simultaneous websocket and http request (KTOR-8259)
  • ktor-network produces ProGuard warning (KTOR-8525)
  • More overloads for StringValuesBuilder.appendAll (KTOR-8573)
  • HttpClientCall: Deprecate wrapWithContent and wrap (KTOR-8378)
  • Add a way to create an ApplicationCall for testing (KTOR-7607)
  • Configuration access API improvements (KTOR-8185)
  • Application instance access in testApplication (KTOR-8215)
  • The TestApplication client should be configurable and mutable (KTOR-8465)
  • Support accessing resolved IP address on an instance of io.ktor.network.sockets.InetSocketAddress (KTOR-8490)
  • Deprecate SaveBodyPlugin in favor of HttpClientCall.save (KTOR-8367)
  • Obscure log message on server startup (KTOR-8519)
  • Routing: accept should return 406 if the Accept header isn't matched (KTOR-8416)
  • MicrometerMetrics: the route label can exceed length limit (KTOR-7274)
  • Micrometer: Make route label configurable (KTOR-8183)
  • Add more common ContentType values (KTOR-7108)
Bugfixes
  • Logging/Darwin: IOException is thrown when detecting if body is a binary (KTOR-8581)
  • Netty: NoSuchElementException or empty headers when responding with 204 (KTOR-8528)
  • YAML configuration: NoSuchElementException when parameter is expanded with curly braces (KTOR-8575)
  • ApplicationConfig: Most of the content is absent after merging configs (KTOR-8565)
  • Android: "ProtocolException: TRACE does not support writing" when sending TRACE request (KTOR-8352)
  • The "Content-Length: 0" header is added for GET requests sent to some servers (KTOR-6508)
  • HttpRequestRetry: requests with some IOException's thrown by Java engine aren't retried (KTOR-6770)
  • HttpCookies: Encoding of request cookies is not preserved in CookiesStorage (KTOR-8343)
  • Url class mangles data URLs (KTOR-5708)
  • SaveBodyPlugin: Logging plugin consumes response body (KTOR-6474)
  • Config deserialization does not respect testApplication environment (KTOR-8436)
  • Resources: Exclude a parent from query params when it is an object (KTOR-8507)
  • BearerAuthProvider does not clear token if refreshTokens returns null (KTOR-8470)
  • Coroutines launched from RoutingContext are not cancelled upon server shutdown (KTOR-8338)
  • Application job is not joined during shutdown (KTOR-8291)
  • HttpCache: InvalidCacheStateException thrown when Vary header has different entries is overly severe (KTOR-8345)
  • Fix socket channel close handling (KTOR-8201)

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻️ Rebasing: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this MR and you won't be reminded about this update again.

  • If you want to rebase/retry this MR, check this box

This MR has been generated by Mend Renovate CLI.

Edited by bullshit

Merge request reports