⬆️ Update all dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Age	Adoption	Passing	Confidence
actions/stale	action	major	v10 → v11
io.ktor:ktor-bom	dependencies	patch	3.5.1 → 3.5.2
com.google.devtools.ksp (source)	plugin	patch	2.3.10 → 2.3.11
com.google.devtools.ksp:com.google.devtools.ksp.gradle.plugin (source)	dependencies	patch	2.3.10 → 2.3.11
dev.detekt	plugin	patch	2.0.0-alpha.5 → 2.0.0-alpha.6
dev.detekt:detekt-gradle-plugin (source)	dependencies	patch	2.0.0-alpha.5 → 2.0.0-alpha.6
dev.detekt:detekt-rules-ruleauthors (source)	dependencies	patch	2.0.0-alpha.5 → 2.0.0-alpha.6
dev.detekt:detekt-rules-libraries (source)	dependencies	patch	2.0.0-alpha.5 → 2.0.0-alpha.6
dev.detekt:detekt-rules-ktlint-wrapper (source)	dependencies	patch	2.0.0-alpha.5 → 2.0.0-alpha.6
dev.detekt:detekt-cli (source)	dependencies	patch	2.0.0-alpha.5 → 2.0.0-alpha.6
dev.detekt:detekt-api (source)	dependencies	patch	2.0.0-alpha.5 → 2.0.0-alpha.6
com.android.compose.screenshot (source)	plugin	patch	0.0.1-alpha15 → 0.0.1-alpha16
com.android.tools.screenshot:screenshot-validation-api	dependencies	patch	0.0.1-alpha15 → 0.0.1-alpha16
com.android.tools:common (source)	dependencies	patch	32.3.0 → 32.3.1
com.android.kotlin.multiplatform.library (source)	plugin	patch	9.3.0 → 9.3.1
com.android.library (source)	plugin	patch	9.3.0 → 9.3.1
com.android.application (source)	plugin	patch	9.3.0 → 9.3.1
com.android.tools.build:gradle (source)	dependencies	patch	9.3.0 → 9.3.1

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

actions/stale (actions/stale)

v11.0.0

Compare Source

What's Changed

Enhancement

• Migrate to ESM and update dependencies by @​chiranjib-swain in #​1350

Dependency Update

• Override brace-expansion to 5.0.8 to address 24 high-severity dependency vulnerabilities by @​dependabot in #​1351

Full Changelog: actions/stale@v10...v11.0.0

v11

Compare Source

ktorio/ktor (io.ktor:ktor-bom)

v3.5.2

Compare Source

Published 31 July 2026

Improvements

• KTOR-8032 RateLimit: Allow limit requests based on authentication result
• KTOR-9719 ApplicationCall.isStaticContent returns false when called from plugin interceptors
• KTOR-8450 ContentNegotiation: it doesn't handle content type suffixes
• KTOR-7892 SwaggerUI: Missing oauth2-redirect.html support in the plugin
• KTOR-9759 Reject whitespace in URL hosts during parsing
• KTOR-9681 Update kotlinx-io to 0.9.1
• KTOR-9743 ByteReadChannel.readLineStrict: Misleading definition of limit parameter in KDocs
• KTOR-9504 Improve KDoc for EmbeddedServer.addShutdownHook

Bugfixes

• KTOR-9741 CIO: request-handler coroutine leak on half-closed idle connection after ≥1MB response
• KTOR-7661 Maven + YAML config file does not work
• KTOR-9585 OpenAPI: JsonSchema title is truncated when it contains a dot
• KTOR-9704 UTF-8 encoding in ktor-io bypasses JVM String.getBytes intrinsics, slowing every text response by 5-7x
• KTOR-9588 SSE client (CIO engine) sends spurious Content-Length: 0 on body-less GET (RFC 9110 § 8.6 violation; rejected by AWS ELB)
• KTOR-9679 ByteReadChannel.readLine corrupts multi-byte UTF-8 by splitting a character at a buffer boundary
• KTOR-9767 ByteReadChannel.readLineTo: Return read bytes count instead of decoded characters count
• KTOR-8992 HoconConfigLoader is not loaded when ktor-server-config-yaml on the classpath
• KTOR-9698 OpenAPI: schema for kotlinx.serialization sealed types omits discriminator property in variant schemas
• KTOR-9690 Netty: in-flight requests are aborted on stop(), ignoring shutdown grace period
• KTOR-8903 Netty: Close channel connection on errors properly
• KTOR-9707 SaveBody performance regression
• KTOR-9703 Inefficient text reading function in DefaultTransform
• KTOR-9711 Netty HTTP/2: a single client-canceled stream (RST_STREAM) breaks response flushing for the whole connection
• KTOR-9688 RateLimit: No access to principal when wrapped with authentication since 3.5.1
• KTOR-9677 Auto-reloading: server is reloaded only once since 3.5.0
• KTOR-9683 Sockets: Canceling a SelectorManager job doesn't close it properly
• KTOR-9671 Darwin: Semicolons in URL path are sanitized

google/ksp (com.google.devtools.ksp)

v2.3.11

Compare Source

detekt/detekt (dev.detekt:detekt-gradle-plugin)

v2.0.0-alpha.6

2.0.0-alpha.6 - 2026-08-04

This is an alpha release of Detekt 2.0.0. It's built against Kotlin 2.4.10, Gradle 9.6.1, AGP 9.3.1 and is tested against JDK 25.

Notable Changes

• The detekt Gradle task now analyzes all Kotlin source sets with type resolution by default, replacing the previous type-resolution-free task - #​7025
• detekt-rules-ktlint-wrapper now targets JVM 17, in preparation for the next ktlint major release which requires JVM 17+, the rest of detekt still targets JVM 8+ - #​9453

Changelog

• feat(rules): add ignoreSealedClasses option to AbstractClassCanBeInterface - #​9557
• docs: drop stale Android compile classpath warning note - #​9550
• Recommend to use Locale.ROOT instead of Locale.US - #​9532
• Recognize params swallowed by KDoc lexer in OutdatedDocumentation - #​9529
• Fix UnusedPrivateProperty false negative for constructor properties - #​9491
• Fix MissingSuperCall false positive when annotation is in grandparent - #​9469
• Fix UseDataClass false positive for properties with a custom accessor - #​9462
• Fix a potential bug on Config.getListOrDefault - #​9461
• Fix UnusedPrivateFunction false positive for overloaded private extension functions with a Java (or generated) receiver type - #​9450
• Fix CanBeNonNullable false negative on local variables - #​9432
• Fix CognitiveComplexMethod false positive for object literal methods - #​9431
• Fix ReturnCount/ThrowsCount false positive where a guard clause following a local variable declaration was still counted (with excludeGuardClauses enabled) - #​9424
• Extend PropertyUsedBeforeDeclaration to follow private init calls - #​9334
• Add configuration ignoredFullyQualifiedNames to UnnecessaryFullyQualifiedName rule - #​9301
• Expose multiline parameter in ClassSignature - #​9084
• Extract interfaces from detekt Gradle tasks - #​7662
• Allow setting default autocorrect mode with Gradle property - #​7040

Dependency Updates

• Update agp to v9.3.1 - #​9538
• Update kotlin monorepo to v2.4.10 - #​9518
• Update Gradle to v9.6.1 - #​9444
• Update Gradle to v9.6.0 - #​9420

Housekeeping & Refactorings

• Reduce scope of @Suppress("UNCHECKED_CAST") - #​9459
• Remove irrelevant test for YamlConfig - #​9457
• fix: handle trailing commas in @​Configuration annotation parsing in JS generator - #​9447
• Production code should not depend on fixtures - #​9439

Contributors

We would like to thank the following contributors that made this release possible: @​3flex, @​BraisGabin, @​ChristophyBarth, @​FilippoVigani, @​Phoenix1808, @​ShubhamWorks02, @​cortinico, @​e5l, @​eyupcanakman, @​iuryeng, @​loganrosen, @​marpalat, @​roian6, @​sahilpatel2521, @​tonytonycoder11

See all issues at: 2.0.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At 10:00 PM through 11:59 PM and 12:00 AM through 04:59 AM (* 22-23,0-4 * * *)
  • Only on Sunday and Saturday (* * * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.