Update ktor monorepo to v3.5.2

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
io.ktor:ktor-serialization-kotlinx-json	3.3.3 → 3.5.2
io.ktor:ktor-client-content-negotiation	3.3.3 → 3.5.2
io.ktor:ktor-client-darwin	3.3.3 → 3.5.2
io.ktor:ktor-client-okhttp	3.3.3 → 3.5.2
io.ktor:ktor-client-core	3.3.3 → 3.5.2

---

Release Notes

ktorio/ktor (io.ktor:ktor-serialization-kotlinx-json)

v3.5.1

Compare Source

Published 25 June 2026

Improvements

• KTOR-9492 OpenAPI plugin: handle requireXxx functions in compiler plugin
• KTOR-9569 Add more details for KDoc of BearerAuthConfig.sendWithoutRequest
• KTOR-9571 Add KDoc for BearerAuthConfig.realm
• KTOR-9570 Add Kdoc for BearerAuthConfig.refreshTokens

Bugfixes

• KTOR-9646 Fix Kotlin 2.4.0 compiler plugin breaking changes
• KTOR-9585 OpenAPI: JsonSchema title is truncated when it contains a dot
• KTOR-9591 OpenAPI: @JsonClassDiscriminator on sealed types is ignored when generating OpenAPI discriminator schema
• KTOR-9597 OpenAPI: Schema name collisions because@SerialName of sealed subtypes is used as components.schemas key
• KTOR-9601 OpenAPI: nullable @​JvmInline value class loses nullability in generated schema
• KTOR-9620 Some issues related to digest authentication in 3.5.0
• KTOR-9623 Digest Auth: server must respond with one WWW-Authenticate header for each supported algorithm
• KTOR-9624 Digest Auth: "Unsupported charset in digest authentication header" for a charset name in lowercase
• KTOR-9630 Digest Auth: The plugin sends incorrect nonce when server responds with multiple WWW-Authenticate headers
• KTOR-9565 WebRTC: Peer stops receiving messages after a while on iOS
• KTOR-9610 WebRtcPeerConnection::close causes ClosedReceiveChannelException for other peer
• KTOR-9633 WebRTC statistics fetching race condition
• KTOR-9603 Structured concurrency is violated in WebRTC tests
• KTOR-9671 Darwin: Semicolons in URL path are sanitized
• KTOR-9639 Darwin: WebSocket client crashes the process when a PONG arrives after the session is closed
• KTOR-9575 Darwin: findCharset("UTF-16") maps to NSUTF16LittleEndianStringEncoding causing decoding failure for UTF-16 content with BOM
• KTOR-9661 HttpCache: InvalidCacheStateException is thrown on 304 when no cached entry matches varyKeys
• KTOR-9673 Caching always missing with Content Negotiation
• KTOR-9596 HttpTimeout: HttpRequestTimeoutException on any request with runTest and request timeout defined since 3.5.0
• KTOR-9632 HttpRequestBuilder.timeout call removes capabilities set in DefaultRequest
• KTOR-9252 ContentEncoding: Incomplete gzip response causes client/server to hang indefinitely
• KTOR-9670 Compression: The plugin ignores Accept-Encoding q=0 and most-specific matching
• KTOR-9614 Zstd Compression: "Destination buffer is too small" exception for a particular sequence of bytes
• KTOR-9636 CORS plugin drops OPTIONS preflight requests when allowSameOrigin is on
• KTOR-9659 CORS is skipped when the Origin header contains an IPv6 address
• KTOR-9574 ContentNegotiation: The charset of Accept-Charset header is used for response deserialization
• KTOR-9606 KotlinxSerializationConverter: it fails to deserialize an empty channel closed with a delay
• KTOR-9617 OutputStreamContent and WriterContent can exhaust Dispatchers.IO
• KTOR-9629 RawSourceChannel: coroutine cancellation is not propagated to the RawSource
• KTOR-8870 File.readChannel: do not close a non-opened file and ignore closing exceptions
• KTOR-9460 Curl: Can't build shared library with Ktor 3.4.2
• KTOR-9607 Crash on Android 7: NoSuchMethodError getInstanceStrong() since 3.5.0
• KTOR-9595 CIO: The engine imports node:net statically and breaks wasmJsBrowser webpack build
• KTOR-9615 Apache5: The underlying request is not aborted when coroutine Job is cancelled
• KTOR-8443 RoutingBuilder.contentType does not use parameters when matching
• KTOR-9425 SessionTransportTransformerEncrypt init block uses wrong IV size for AES-256 (regression of KTOR-661)
• KTOR-9621 RateLimit plugin is bypassed when the nested authenticate block rejects the request
• KTOR-8766 DI: The close method is called twice on cleanup of AutoCloseable
• KTOR-8695 GMTDate() being offset by 369 years on Windows
• KTOR-9589 Duplicate PROPERTY_SETTER target in @​InternalAPI annotation
• KTOR-9602 Gradle plugin environment variable is not included in the image

v3.5.0

Compare Source

Published 14 May 2026

Features

• KTOR-8421 Route.contentType should support multiple ContentType
• KTOR-7961 Add known TDM headers to the HttpHeaders object
• KTOR-9418 Support getAs from the root ApplicationConfig
• KTOR-9559 DNS configuration for the Apache5 client
• KTOR-9554 DNS configuration for OkHttp client engine
• KTOR-9555 Custom SSE heartbeat function
• KTOR-8914 Dependency injection: read annotations in function references
• KTOR-8300 Sessions: Add a way to create a user session shared for all user devices or look up sessions of the same user
• KTOR-9521 Upgrade to Kotlin 2.3.21
• KTOR-9276 Make DynamicProviderConfig.authenticateFunction suspend
• KTOR-9491 Provide parameter validation convenience functions
• KTOR-9506 OpenAPI: Support prefixItems in JsonSchema for tuple type definitions
• KTOR-470 Add an option to not resend the session cookie if the session data wasn't changed.
• KTOR-9355 Deprecate HttpHeaders.AcceptCharset
• KTOR-7659 Make ktor-network compatible with ES modules for nodejs
• KTOR-9350 JS: Make ES2015 the default target for tests
• KTOR-7578 Update Digest authentication implementation according to RFC 7616

Improvements

• KTOR-9503 The JacksonConverter.streamRequestBody property name is confusing
• KTOR-9552 Deprecation notice for io.ktor.server.auth.Principal does not explain what to use instead
• KTOR-7458 Jetty Jakarta: Provide an easy way to disable SNI hostname validation
• KTOR-9354 Websockets: webSocket builder function should return a Route to be describable
• KTOR-9488 Nonce and hex function performance optimizations

Bugfixes

• KTOR-9524 Netty response hangs after connection lost
• KTOR-9542 Netty: The request handler runs on worker event loop instead of call event loop since 3.4.3
• KTOR-9531 Netty server intermittently drops requests after upgrading to 3.4.3
• KTOR-8151 MicrometerMetrics: "MeterFilters configured after a Meter has been registered" warning when a metric is registered before installing the plugin
• KTOR-9411 Darwin throws DarwinHttpRequestException instead of FrameTooBigException
• KTOR-8320 CallLogging: plugin usage in testApplication breaks console standard output
• KTOR-8906 Jackson, with request body streaming on, exhausts Dispatchers.IO
• KTOR-8709 Websockets: Unable to close session with a custom CloseReason
• KTOR-9567 Flaky UnixSockets on Windows: WSAEOPNOTSUPP from bind()
• KTOR-9183 A client call wrapped with withTimeout throws a generic CancellationException instead of TimeoutCancellationException
• KTOR-8199 Autoreloading: default watch patterns don't match anything when project path contain spaces
• KTOR-9549 Kotlin/JS: ktor-ktor-client-core.mjs is incompatible with Vite: toRaw naming conflict
• KTOR-9544 Apache: body channel not cancelled when caller scope is cancelled
• KTOR-9546 HttpClient: cancelling ByteReadChannel body does not propagate to engine
• KTOR-455 Content-Disposition additional parameters should be inside quotes
• KTOR-9500 RawSourceChannel returns false positive on awaitContent
• KTOR-646 Netty engine still print annoying exceptions
• KTOR-9527 Curl: Freeze when receiving large responses
• KTOR-9460 Curl: Can't build shared library with Ktor 3.4.2
• KTOR-9483 Curl: backpressure implementation is never used
• KTOR-9545 Curl: body channel not cancelled when caller scope is cancelled
• KTOR-9540 Curl: CancelWebSocket task may cancel a new HTTP request due to easy handle pointer reuse
• KTOR-9539 Curl: WebSocket bearer token refresh fails due to stale native handle reuse
• KTOR-9536 Netty call hang when channel becomes inactive before response is sent
• KTOR-4752 OkHttp: Websockets pinging doesn't work
• KTOR-9409 call.respond performance regression caused by transitive kotlin-reflect:2.3.0
• KTOR-9487 ZSTD decoder fails if the compressed frame is larger than 4096 bytes
• KTOR-8271 MockEngine, HttpTimeout: the virtual clock of kotlinx coroutines isn't respected
• KTOR-6683 Plugin onCallReceive/transformBody is not called for receive()
• KTOR-7416 Jetty, Java: Custom Host header doesn't override the default value
• KTOR-9203 CIOMultipartDataBase: Call thread is blocked when releasing file parts

v3.4.3

Compare Source

Published 22 April 2026

Bugfixes

• KTOR-9451 OpenAPI schema inference not working for custom nested generics
• KTOR-9490 OpenAPI: Self-referential schema $ref uses FQN while schema is registered with a simple name
• KTOR-9463 OpenAPI: schema inference StackOverflow
• KTOR-8938 WebSockets: WebSockets handler does not inherit server coroutine context
• KTOR-8989 Shared engine is closed when a client created with config method is closed
• KTOR-9485 Apache5: FutureCallback never called, breaking Java agent instrumentation
• KTOR-9497 Darwin: SIGABRT crash when close() races with in-flight execute() since 3.4.2
• KTOR-9431 SuspendFunctionGun: ThreadContextElement leaks across requests when interceptor suspends
• KTOR-9423 CannotTransformContentToTypeException leaks internal class names in response body
• KTOR-9461 Incorrect link to the OWASP cheatsheet in the KDoc for CSRF plugin
• KTOR-9476 Unable to update/remove session data if no response content
• KTOR-9343 HttpRequestLifecycle plugin with cancelCallOnClose on, cancels subsequent requests when CallLogging plugin with callIdMdc is installed

v3.4.2

Compare Source

Published 27 March 2026

Improvements

• KTOR-9327 Curl: The WebSockets maxFrameSize option does not have an effect
• KTOR-9383 CaseInsensitiveString: reduce allocations
• KTOR-9385 Netty: Allocation micro-optimizations
• KTOR-9403 Darwin: Unnecessary ByteArray copy for each received response chunk
• KTOR-9412 KDoc for formFieldLimit documents incorrect default value (64 KB instead of 50 MiB)

Bugfixes

• KTOR-9351 OpenAPI: Incorrect schema generated for nested classes with lists
• KTOR-9361 WebSockets: JsWebSocketSession._closeReason is completed twice
• KTOR-9437 Fix GraalVM Compatibility
• KTOR-9424 Logging: OkHttp format should log the full requested URL
• KTOR-8540 Logging: IllegalStateException is thrown when response is cached and deserialization fails
• KTOR-9370 OpenAPI: NoSuchMethodError - getLOCAL_FUNCTION_FOR_LAMBDA with Kotlin 2.3.20-*
• KTOR-9421 Netty: active SSE connection blocks HTTP/2 response flushing for other requests
• KTOR-3390 JS browser: "Failed to execute 'digest' on 'SubtleCrypto'" error when using digest auth
• KTOR-5977 Compression: The encoders buffer streaming response
• KTOR-9393 Certificate pinning matches against all pins instead of hostname-scoped pins
• KTOR-8751 DI: AmbiguousDependencyException when named dependency is overridden in testApplication
• KTOR-9039 Bearer Auth: Request body transformed with jsonIO isn't sent over again after refreshToken request
• KTOR-9404 Darwin: Memory leak in KtorNSURLSessionDelegate
• KTOR-9399 LinkageError when running Ktor app with development mode inside Spring Boot / Amper fat-JAR
• KTOR-9402 NoSuchMethodError on RawWebSocket after 3.4.0
• KTOR-9372 Frame.Text.readText() causes infinite loop and 100% CPU on Kotlin/Native when WebSocket frame data is malformed or connection drops unexpectedly
• KTOR-9387 ZstdEncoder decode fails when source data is split into multiple Zstd frames

v3.4.1

Compare Source

Published 3 March 2026

Improvements

• KTOR-9382 HttpProtocolVersion.parse: fast path for common versions
• KTOR-9381 GMTDate: reduce allocations
• KTOR-8971 Support "operationId" in Kdoc for OpenAPI spec. gen.
• KTOR-9333 WebSockets: Infinite spin and potential OOM vulnerabilities in the Inflater.inflateFully method
• KTOR-5616 Ktor always adds by default an Accept-Charset header
• KTOR-9291 OpenAPI: handle atypical route functions
• KTOR-9293 OpenAPI describe needs defaults
• KTOR-9304 OpenAPI: Order of path parameters is not preserved in the spec
• KTOR-9353 Routing: TailcardSelector missing toString(), which clutters the logs

Bugfixes

• KTOR-9281 OpenApi code inference misses lambda argument bodies
• KTOR-9273 OpenAPI static content path appears in resulting model
• KTOR-9004 OpenAPI: No respective formats detected for serializable types like UUID or Instant
• KTOR-9305 OpenAPI: "No mapping for symbol: VAR FOR_LOOP_VARIABLE" error with codeInferenceEnabled=true
• KTOR-9279 OpenAPI: UnsupportedOperationException for a function with a reified type parameter codeInferenceEnabled = true
• KTOR-9289 OpenAPI: Resource routes are missing inferred and comment-based documentation
• KTOR-9330 OpenAPI: Cannot override kotlinx.serialization module
• KTOR-9320 OpenAPI: jsonSchema() does not unwrap Kotlin value classes (inline classes)
• KTOR-9352 Authentication: Creating JWT verifier fails for JWK with kty=EC and alg=null
• KTOR-9344 Flow invariant error happens after update to Ktor 3.4.0
• KTOR-9362 testApplication: Race condition in timeout coroutine when response is streaming
• KTOR-9274 Curl: Undefined symbol errors when linking on Linux since 3.4.0
• KTOR-8782 NodeJS CIO: "Module 'os' could not be imported" error on resolving WORKING_DIRECTORY_PATH with es2015 target
• KTOR-9348 String.decodeBase64String fails to decode when the input has no padding since 3.4.0
• KTOR-9318 CIO engine rejects valid certificates with unsupported signature algorithms
• KTOR-9331 Curl: Segfaults when working with WebSockets
• KTOR-9334 Coroutines in route handlers are dispatched with Dispatchers.Unconfined since 3.2.0
• KTOR-9339 StreamResetException is not propagated to the caller of StreamRequestBody.writeTo since 3.4.0
• KTOR-9329 HTMX: "on" attributes extension not working
• KTOR-9316 WasmJS bad get and set implementations for Uint8Array and ArrayLike
• KTOR-9272 JSON schema inference does not recognize unsigned types
• KTOR-9211 SendCountExceedException when request is sent twice with maxRetries = 0 since 3.3.2
• KTOR-9285 RateLimit: Milliseconds in the Retry-After header are truncated
• KTOR-7512 JWT: Docs for validate method claim that it's optional, but it isn't
• KTOR-9269 Incorrect dependency declaration in swagger / openapi
• KTOR-9372 Frame.Text.readText() causes infinite loop and 100% CPU on Kotlin/Native when WebSocket frame data is malformed or connection drops unexpectedly

v3.4.0

Compare Source

Published 22 January 2026

Features

• KTOR-8316 Support OpenAPI specification for the Ktor Client and Server Application
  • KTOR-9085 Read OpenAPI security details from authentication plugin
  • KTOR-8993 Use runtime-generated spec for OpenAPI / Swagger plugins
  • KTOR-9086 Read OpenAPI default content type information from ContentNegotiation plugin
  • KTOR-8859 Routing documentation compiler plugin
  • KTOR-8936 Routing documentation runtime API
  • KTOR-9087 Generate JSON schema for type references when using Jackson and Gson
• KTOR-7075 Zstd support
• KTOR-9209 Support Jackson 3
• KTOR-9198 Auth/Bearer: Make BearerAuthProvider detect disguised Bearer scheme
• KTOR-8927 Support for respondResource
• KTOR-9162 Auth API key plugin
• KTOR-7882 Support HTTP QUERY method
• KTOR-8195 Partial HTML response
• KTOR-8985 EngineMain: Support reading trust store settings from the configuration
• KTOR-9066 Add duplex streaming for OkHttpClient
• KTOR-8180 Auth: Provide control over tokens to user code
• KTOR-8273 iOS native interop for WebRTC client
• KTOR-8956 DI: Allow file configuration
• KTOR-9157 Support SIGINT on web and SIGTERM on Native

Improvements

• KTOR-8890 Rename target jsAndWasmShared to web
• KTOR-9242 Upgrade to Kotlin 2.3
• KTOR-9243 Update libcurl to 8.18.0
• KTOR-9014 Deprecate DarwinLegacy engine
• KTOR-8931 Test iOS target of the WebRTC Client in Ktor-Chat
• KTOR-9199 Make HttpHeaders strings const
• KTOR-9208 Expose plusIsSpace in parseUrlEncodedParameters
• KTOR-2404 Ktor Oauth2 feature sends 401 response when the client secret is invalid
• KTOR-9097 Java: Use HTTP/2 by default
• KTOR-8740 HTMX: Missing DSL for some attributes
• KTOR-9171 Redesign ByteReadChannel.readUTF8Line API
• KTOR-4219 Make readUTF8LineTo return number of read symbols instead of boolean
• KTOR-6761 Apache5: Simplify configuration of ConnectionManager
• KTOR-9037 Multipart/form-data: Make formData's block inline
• KTOR-9126 Missing function ByteReadChannel.readTo(sink: RawSink, byteCount: Long)
• KTOR-9026 Introduce/reuse interfaces for logging selectors
• KTOR-6766 Deprecate Apache 4 engine
• KTOR-8642 Excessive memory allocations while writing bytes into write channel of TCP/IP socket
• KTOR-9137 ByteReadChannel.readUTF8Line is inefficient for long lines
• KTOR-8657 Remove kotlinx-datetime from ktor-server-default-headers dependencies
• KTOR-8941 Add override DI conflict policy

Bugfixes

• KTOR-9258 headers { } block does not affect the request in defaultRequest due to function name collision with io.ktor.http.headers
• KTOR-9235 HttpCookies: Support parsing non-compilant Expires dates of Set-Cookie header
• KTOR-8945 ByteReadChannel.readUTF8Line doesn't throw TooLongLineException when the limit is reached
• KTOR-8339 Curl: caPath is not set by default in the Curl client on linuxArm64
• KTOR-9188 WebRTC. IceServer.urls should be a list.
• KTOR-9148 Logging: Body logging of multipart/form-data requests hangs when OkHttp format is on
• KTOR-9166 CORS: Excessive logs on INFO level since 3.3.3
• KTOR-9130 Missing implementation of getPluginId method error with Kotlin 2.3.0-RC
• KTOR-9147 OpenAPI: "AssertionError: Cannot add a performance measurements" leading to StackOverflowError within a multimodule project
• KTOR-2162 JettyKtorHandler executor will never grow beyond core size
• KTOR-9201 audio/x-matroska is wrongly recognized as mkv type
• KTOR-9146 Run HttpStatement.execute on the engine's dispatcher
• KTOR-6300 Native engines should use Dispatchers.IO not Dispatchers.Unconfined
• KTOR-9098 Curl: HttpResponse.version always returns HTTP_1_1
• KTOR-9100 Curl always uses HTTP/1.1
• KTOR-7162 DefaultRequest: Configuration applied twice for client created with HttpClient.config
• KTOR-9102 SSE: Java engine does not close the underlying connection when SSE session is canceled
• KTOR-9108 SSE: The handler adds Connection: Keep-Alive header, which is incompatible with HTTP/2
• KTOR-7884 Auth: The MutableList cannot be accessed since 3.0.0
• KTOR-6569 Bearer auth: Don't cache client bearer token (option)
• KTOR-4946 Auth: Bearer authentication - unable to update tokens
• KTOR-4759 Auth: BearerAuthProvider caches result of loadToken until process death
• KTOR-9129 Fix SendCountExceedException when maxRetries = Int.MAX_VALUE
• KTOR-9113 Netty HTTP2 server hangs on the plugin exception
• KTOR-9135 buildOpenApi fails with unknown serializer
• KTOR-8285 Bearer Auth: request cancellation causes refresh token invalidation
• KTOR-5241 The decodeBase64Bytes method doesn't throw an exception on illegal base64 characters
• KTOR-8912 Incorrect KDoc of ApplicationConfig.tryGetStringList
• KTOR-9079 The ktor-server-test-host module, having junit-jupiter runtime dependency, causes conflicts
• KTOR-7713 HttpCallValidatorConfig.handleResponseException() should receive a CallExceptionHandler
• KTOR-7121 testApplication: Test HTTP client does not use specified coroutine dispatcher
• KTOR-8785 DI: JobCancellationException during cleanup
• KTOR-6198 Client/WebSocket/Darwin close code and reason are incorrect
• KTOR-7824 Ktor doesn't parse multiple headers

---

• If you want to rebase/retry this PR, check this box

---

🔕 Ignore: Close this PR and you won't be reminded about these updates again.