Update all dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
com.github.ben-manes.caffeine:caffeine	3.2.2 -> 3.2.3
org.graalvm.buildtools.native	0.11.1 -> 0.11.2
dev.detekt	2.0.0-alpha.0 -> 2.0.0-alpha.1
dev.detekt:detekt-rules-ktlint-wrapper (source)	2.0.0-alpha.0 -> 2.0.0-alpha.1
com.google.cloud:google-cloud-firestore	3.33.1 -> 3.33.3
io.ktor:ktor-serialization-kotlinx-xml	3.1.3 -> 3.3.1
io.ktor:ktor-serialization-kotlinx-json	3.1.3 -> 3.3.1
io.ktor:ktor-client-mock	3.1.3 -> 3.3.1
io.ktor:ktor-client-content-negotiation	3.1.3 -> 3.3.1
io.ktor:ktor-client-okhttp	3.1.3 -> 3.3.1
io.ktor:ktor-client-core	3.1.3 -> 3.3.1
org.springframework.boot	3.5.6 -> 3.5.7
org.jetbrains.kotlin.plugin.noarg	2.2.20 -> 2.2.21
org.jetbrains.kotlin.plugin.power-assert	2.2.20 -> 2.2.21
org.jetbrains.kotlin.plugin.serialization	2.2.20 -> 2.2.21
org.jetbrains.kotlin.plugin.spring	2.2.20 -> 2.2.21
org.jetbrains.kotlin.jvm	2.2.20 -> 2.2.21

---

Release Notes

ben-manes/caffeine (com.github.ben-manes.caffeine:caffeine)

v3.2.3: 3.2.3

• Fixed frequency tracking of weak keys to use the object's identity hash code (#​1902)
• Added support for underscores in CaffeineSpec when using numeric literals (#​1890)
• Improved the external api to no longer lock when querying for the maximum size or weighted size (#​1897)
• Added detection and recovery when a custom CompletableFuture is in an inconsistent state (quarkus#50513)

graalvm/native-build-tools (org.graalvm.buildtools.native)

v0.11.2

Compare Source

What's Changed

• Create release 0.11.1 by @​graalvmbot in #​775
• bump version to 0.11.2 SNAPSHOT by @​graalvmbot in #​776
• fix junit missing classes from initialize-at-buildtime #​780 by @​n0tl3ss in #​781
• Adds two new switches to the maven test goal by @​hgschmie in #​720
• add missing junit classes by @​n0tl3ss in #​783

New Contributors

• @​hgschmie made their first contribution in #​720

Full Changelog: graalvm/native-build-tools@0.11.1...0.11.2

detekt/detekt (dev.detekt:detekt-rules-ktlint-wrapper)

v2.0.0-alpha.1

2.0.0-alpha.1 - 2025-10-21

This is an alpha release of Detekt 2.0.0. Is built against Kotlin 2.2.20, Gradle 9.1.0 and is tested against JDK 25.

Full changelog is available here: https://detekt.dev/changelog-2.0.0

Requirements

Detekt Version	Gradle	Kotlin	AGP	Java Target Level	JDK Max Version
2.0.0-alpha.1	9.1.0	2.2.20	8.13.0	1.8	25

Contributors

We would like to thank the following contributors that made this release possible: @​3flex @​BraisGabin @​Copilot @​CziSKY @​atulgpt @​jonapoul @​marschwar @​mikaelreiersolmoen

See all issues at: 2.0.0

googleapis/java-firestore (com.google.cloud:google-cloud-firestore)

v3.33.3

Dependencies

• Update dependency com.google.cloud:sdk-platform-java-config to v3.53.0 (#​2249) (e50d2da)

v3.33.2

Bug Fixes

• deps: Update the Java code generator (gapic-generator-java) to 2.62.3 (75901e3)

Dependencies

• Update dependency com.google.cloud:sdk-platform-java-config to v3.52.3 (#​2243) (dfe553a)

ktorio/ktor (io.ktor:ktor-serialization-kotlinx-xml)

v3.3.1

Compare Source

Published 8 October 2025

Improvements

• Add a note about SSE session lifetime in KDoc (KTOR-8440)
• Update Kotlin to 2.2.20 (KTOR-8896)

Bugfixes

• NumberFormatException when Content-Length header value contains null bytes (KTOR-4828)
• SerializationException: Serializer for class 'ClientSSESession' is not found when server responds with JSON (KTOR-7631)
• Netty: loadConfiguration missing enableHttp2 and enableH2c properties (KTOR-8898)
• Netty: EmbeddedServer.stop always blocks for twice of shutdownGracePeriod (KTOR-8770)
• shutdownGracePeriod is used instead of shutdownTimeout in EmbeddedServer.stop() (KTOR-8771)
• Support serving static resources within bootJar (KTOR-8592)

v3.3.0

Compare Source

Published 11 September 2025

Features

• Support for server side http2 without tls (h2c) (KTOR-4750)
• OpenAPI generation build extension preview (KTOR-8721)
• Serve static resources with caching headers and ETag based on sha256 of content (KTOR-6700)
• Jetty engine: Upgrade Jetty dependencies to the latest version 12 (KTOR-6734)
• Static content: Support a custom respond logic if the file is not found (KTOR-8496)
• Upgrade OkHttp to version 5.0.0 (KTOR-8652)
• WebRTC Client, Android + WASM (KTOR-7958)

Improvements

• SSE: Cannot read response body from SSEClientException (KTOR-8165)
• SSE: "SSEClientException: Content-Length mismatch" on saving response body in DefaultResponseValidation (KTOR-8753)
• var Route.staticRootFolder: File? should be deprecated (KTOR-5836)
• Add image/bmp to the ContentType (KTOR-8735)
• Add some missing image content types (KTOR-8624)
• Upgrade to Kotlin 2.2 (KTOR-8647)
• Bump Kotlin API level to 2.2 (KTOR-8637)
• CIO: The engine ignores system proxy settings (KTOR-5922)

Bugfixes

• Performance regression when using ContentEncoding and HttpRequestRetry since 3.2.0 (KTOR-8820)
• Big number of simultaneous outbound web socket connections leads to a coroutine deadlock (KTOR-8829)
• DI: JobCancellationException during cleanup (KTOR-8785)
• Autoreloading: JobCancellationException when app is reloaded in the debugger since 3.2.0 (KTOR-8810)
• HttpRedirect: The client is redirected when no Location header in response (KTOR-8697)
• SerializationException when Application.propertyOrNull() is called with type Map<String, Any?> (KTOR-8781)
• "Failed resolution of: Ljava/lang/management/ManagementFactory" on Android when JvmGcMetrics are initialized (KTOR-8714)
• HttpCache: all header values but first in HttpResponse.varyKeys() are ignored (KTOR-6402)
• HttpCache: plugin selects wrong cache entry when filtering Vary headers with different case (KTOR-7621)
• CountedByteWriteChannel: autoFlush of the source channel doesn't make the channel auto flushing (KTOR-8411)

v3.2.3

Compare Source

Published 29 July 2025

Improvements

• Server only accepts yaml as the configuration file suffix (KTOR-8712)
• JS / WASM error when process global is undefined (KTOR-8686)
• DI async duplicate resolution (KTOR-8681)

Bugfixes

• CIO: Expect 100-continue response is missing a final \r\n (KTOR-8687)
• Intermittent "ParserException: No colon in HTTP header" when parsing multipart request (KTOR-8523)
• Infinite loop in ByteReadChannel.readFully (KTOR-8682)
• ShutDownUrl: The server cannot shut down since 3.2.0 (KTOR-8674)

v3.2.2

Compare Source

Published 14 July 2025

Improvements

• SSE: Change the order of SSE field serialization: put event before data (KTOR-8627)

Bugfixes

• CORS: server replies with the 405 status code on a preflight request when the plugin is installed in a route (KTOR-4499)
• Darwin: The Content-Encoding header is removed since 3.0.3 (KTOR-8526)
• JS/WASM: response doesn't contain the Content-Length header in a browser (KTOR-8377)
• StatusPages: response headers of OutgoingContent aren't available in the status handlers (KTOR-8232)
• testApplication: The client.sse() acts like a REST call and not a stream in test environment (KTOR-7910)
• Config deserialization - default properties problem (KTOR-8654)
• kotlinx.datetime is not available transitively in 3.2.1 (KTOR-8656)
• Request builder block overrides HTTP method in specific request builders (get, post, etc) (KTOR-8636)

v3.2.1

Compare Source

Published 3 July 2025

Improvements

• Replace kotlinx.datetime APIs with kotlin.time (KTOR-8635)
• Thymeleaf: null values in template model (KTOR-8559)
• Publish Javadoc as a maven artifact (KTOR-3962)
• Netty: Invalid hex byte with malformed query string (KTOR-2934)

Bugfixes

• "Space characters in SimpleName" error when executing R8 mergeExtDex task with 3.2.0 (KTOR-8583)
• ForwardedHeaders: the plugin does not handle parameters case-insensitively (KTOR-8622)
• Potential race condition in socket.awaitClosed (hangs indefinitely) since 3.2.0 (KTOR-8618)
• Module parameter type Application.() -> kotlin.Unit is not supported in 3.2.0 (KTOR-8602)
• OkHttp: java.net.ProtocolException when sending MultiPartFormDataContent with onUpload (KTOR-6790)
• OAuth2 authentication provider breaks form-urlencoded POST requests when receiving request body (KTOR-4420)
• 404 for a link in KDoc for io.ktor.server.plugins.contentnegotiation.ContentNegotiation (KTOR-8597)
• Ktor fails to boot with default jvminline argument (KTOR-8608)
• Flow invariant is violated since 3.2.0 (KTOR-8606)
• ResponseSent hook handler of the plugin installed into a route isn't executed when an exception is thrown from the route (KTOR-6794)

v3.2.0

Compare Source

Published 12 June 2025

Features

• Dependency injection Ktor extension (KTOR-8267)
• Support Version Catalog (KTOR-8162)
• Unix domain socket support at the Ktor Engine level (KTOR-4766)
• Allow suspend Ktor modules (KTOR-8005)
• Ability to use browser cookie storage (KTOR-539)
• Configuration file deserialization (KTOR-7874)
• HttpCache: Support evicting/clearing cache (KTOR-6653)
• File configuration for dependencies (KTOR-8304)

Improvements

• Excessive allocation of ApplicationConfig when loading multiple files from CLI (KTOR-8563)
• Linux curl engine doesn't work for simultaneous websocket and http request (KTOR-8259)
• ktor-network produces ProGuard warning (KTOR-8525)
• More overloads for StringValuesBuilder.appendAll (KTOR-8573)
• HttpClientCall: Deprecate wrapWithContent and wrap (KTOR-8378)
• Add a way to create an ApplicationCall for testing (KTOR-7607)
• Configuration access API improvements (KTOR-8185)
• Application instance access in testApplication (KTOR-8215)
• The TestApplication client should be configurable and mutable (KTOR-8465)
• Support accessing resolved IP address on an instance of io.ktor.network.sockets.InetSocketAddress (KTOR-8490)
• Deprecate SaveBodyPlugin in favor of HttpClientCall.save (KTOR-8367)
• Obscure log message on server startup (KTOR-8519)
• Routing: accept should return 406 if the Accept header isn't matched (KTOR-8416)
• MicrometerMetrics: the route label can exceed length limit (KTOR-7274)
• Micrometer: Make route label configurable (KTOR-8183)
• Add more common ContentType values (KTOR-7108)

Bugfixes

• Logging/Darwin: IOException is thrown when detecting if body is a binary (KTOR-8581)
• Netty: NoSuchElementException or empty headers when responding with 204 (KTOR-8528)
• YAML configuration: NoSuchElementException when parameter is expanded with curly braces (KTOR-8575)
• ApplicationConfig: Most of the content is absent after merging configs (KTOR-8565)
• Android: "ProtocolException: TRACE does not support writing" when sending TRACE request (KTOR-8352)
• The "Content-Length: 0" header is added for GET requests sent to some servers (KTOR-6508)
• HttpRequestRetry: requests with some IOException's thrown by Java engine aren't retried (KTOR-6770)
• HttpCookies: Encoding of request cookies is not preserved in CookiesStorage (KTOR-8343)
• Url class mangles data URLs (KTOR-5708)
• SaveBodyPlugin: Logging plugin consumes response body (KTOR-6474)
• Config deserialization does not respect testApplication environment (KTOR-8436)
• Resources: Exclude a parent from query params when it is an object (KTOR-8507)
• BearerAuthProvider does not clear token if refreshTokens returns null (KTOR-8470)
• Coroutines launched from RoutingContext are not cancelled upon server shutdown (KTOR-8338)
• Application job is not joined during shutdown (KTOR-8291)
• HttpCache: InvalidCacheStateException thrown when Vary header has different entries is overly severe (KTOR-8345)
• Fix socket channel close handling (KTOR-8201)

---

Configuration

📅 Schedule: Branch creation - "on Saturday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.