⬆️ Update all dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change	Age	Adoption	Passing	Confidence
actions/setup-java	action	major	v5 → v6
actions/stale	action	major	v10 → v11
gradle (source)		minor	9.6.1 → 9.8.0
mike		minor	2d4ad799442f4592db8ad53b179bfb33db8c69ac → 2.2.0+zensical-0.1.0
zensical (changelog)		patch	==0.0.60 → ==0.0.64
io.nlopez.compose.rules:detekt	dependencies	patch	0.6.3 → 0.6.6
me.tylerbwong.gradle.metalava	plugin	patch	0.5.0 → 0.5.1
me.tylerbwong.gradle.metalava:plugin	dependencies	patch	0.5.0 → 0.5.1
io.ktor:ktor-bom	dependencies	minor	3.5.1 → 3.6.0
com.google.devtools.ksp (source)	plugin	patch	2.3.10 → 2.3.12
com.google.devtools.ksp:com.google.devtools.ksp.gradle.plugin (source)	dependencies	patch	2.3.10 → 2.3.12
io.kotest	plugin	patch	6.2.3 → 6.2.5
io.kotest:kotest-bom	dependencies	patch	6.2.3 → 6.2.5
co.touchlab:kermit	dependencies	minor	2.1.0 → 2.2.0
dev.detekt	plugin	patch	2.0.0-alpha.5 → 2.0.0-alpha.6
dev.detekt:detekt-gradle-plugin (source)	dependencies	patch	2.0.0-alpha.5 → 2.0.0-alpha.6
dev.detekt:detekt-rules-ruleauthors (source)	dependencies	patch	2.0.0-alpha.5 → 2.0.0-alpha.6
dev.detekt:detekt-rules-libraries (source)	dependencies	patch	2.0.0-alpha.5 → 2.0.0-alpha.6
dev.detekt:detekt-rules-ktlint-wrapper (source)	dependencies	patch	2.0.0-alpha.5 → 2.0.0-alpha.6
dev.detekt:detekt-cli (source)	dependencies	patch	2.0.0-alpha.5 → 2.0.0-alpha.6
dev.detekt:detekt-api (source)	dependencies	patch	2.0.0-alpha.5 → 2.0.0-alpha.6
com.android.compose.screenshot (source)	plugin	patch	0.0.1-alpha15 → 0.0.1-alpha16
com.android.tools.screenshot:screenshot-validation-api	dependencies	patch	0.0.1-alpha15 → 0.0.1-alpha16
io.coil-kt.coil3:coil-bom	dependencies	minor	3.5.0 → 3.6.3
androidx.sqlite:sqlite-bundled (source)	dependencies	patch	2.7.0 → 2.7.1
androidx.room (source)	plugin	patch	2.8.4 → 2.8.5
androidx.room:room-gradle-plugin (source)	dependencies	patch	2.8.4 → 2.8.5
androidx.room:room-paging (source)	dependencies	patch	2.8.4 → 2.8.5
androidx.room:room-runtime (source)	dependencies	patch	2.8.4 → 2.8.5
androidx.room:room-compiler (source)	dependencies	patch	2.8.4 → 2.8.5
androidx.navigation:navigation-compose (source)	dependencies	minor	2.9.8 → 2.10.2
androidx.compose:compose-bom	dependencies	minor	2026.06.01 → 2026.09.00
com.android.tools:common (source)	dependencies	minor	32.3.0 → 32.4.1
com.android.kotlin.multiplatform.library (source)	plugin	minor	9.3.0 → 9.4.1
com.android.library (source)	plugin	minor	9.3.0 → 9.4.1
com.android.application (source)	plugin	minor	9.3.0 → 9.4.1
com.android.tools.build:gradle (source)	dependencies	minor	9.3.0 → 9.4.1

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

actions/setup-java (actions/setup-java)

v6.0.1

Compare Source

v6.0.0

Compare Source

actions/stale (actions/stale)

v11.0.0

Compare Source

What's Changed

Enhancement

• Migrate to ESM and update dependencies by @​chiranjib-swain in #​1350

Dependency Update

• Override brace-expansion to 5.0.8 to address 24 high-severity dependency vulnerabilities by @​dependabot in #​1351

Full Changelog: actions/stale@v10...v11.0.0

gradle/gradle (gradle)

v9.8.0

Compare Source

v9.7.1

Compare Source

v9.7.0

Compare Source

zensical/zensical (zensical)

v0.0.64: 0.0.64

Compare Source

Summary

Many of you have been waiting for this one: Zensical now includes native blog support. As a direct port of the Material for MkDocs blog plugin, it preserves the familiar configuration, metadata, URLs, archives, categories, authors, pagination, and more. We're happy to finally put it into your hands, with more flexible blogging functionality planned for the future.

Changelog

Features

• 5825381 zensical, compat, ui – add blog plugin replacement

Bug fixes

• a85875e ui – update ui to v0.0.32

v0.0.63: 0.0.63

Compare Source

Summary

This version ensures pages containing snippets rebuild when source files change during local preview and excludes hidden files and directories from the generated site. It also fixes preview-site root redirects and returns proper 404 responses while preserving custom error pages.

Additionally, the user interface is updated to v0.0.31, fixing empty submenus for sections containing only an index page and improving task list checkbox sizing and alignment in the modern theme. It also updates dependencies and adds 60 new icons across Lucide, Octicons, and Simple Icons.

Changelog

Bug fixes

• a771962 ui – update ui to v0.0.31
• dfe8f94 zensical – rebuild pages containing snippets on source changes (#​950)
• d6cd5d5 zensical, zensical-serve – append trailing slash to preview site root (#​944)
• 2070bf1 zensical, compat – don't add dotfiles to final site (#​945)

v0.0.62: 0.0.62

Compare Source

Summary

This version adds support for the mkdocs-callouts plugin, which renders Obsidian-style callouts as admonitions. It also improves compatibility with existing MkDocs projects by accepting more plugin settings and fixes builds when the project configuration file is included in watch.

Additionally, the user interface is updated to v0.0.30, ensuring that anchor links reveal targets inside collapsed details, content tabs, and annotations – including deeply nested combinations – before scrolling to them.

Changelog

Features

• d8fbb05 compat – support mkdocs-callouts plugin by enabling pymdownx.quotes extension with callouts support (#​938)

Bug fixes

• 65a019d ui – update ui to v0.0.30
• 5c0bd36 compat – ignore config file in watch setting (#​934)
• 13fd89e compat – relax mike settings validation (#​932)

Refactorings

• 9f36bb5 compat – relax all plugins validation

v0.0.61: 0.0.61

Compare Source

Summary

This version adds more comprehensive support for documentation redirects in mkdocs.yml and zensical.toml. Zensical supports page and anchor redirects, resolves redirect chains, rejects cycles, and preserves links when pages are moved or split.

Anchor redirects

Renaming a heading normally breaks bookmarks and external links to its old anchor. For example, after renaming ## Installation to ## Getting started, add:

[project.plugins.redirects.redirect_maps]
"guide.md#installation" = "guide.md#getting-started"

Existing links to /guide/#installation will then redirect to /guide/#getting-started. The same configuration can redirect anchors between pages or preserve individual sections when splitting a page.

Automatic redirects

Zensical Studio detects renamed headings and offers an Add anchor redirect CodeLens. It can complete, validate, navigate to, and repair redirect targets while compacting repeated changes, updating redirect chains, and removing redundant self-redirects.

Changelog

Features

• 215d7fa zensical, compat – resolve redirect chains and reject cycles
• a6fdc5f zensical, compat – resolve anchor overrides in page redirects
• 0b1a378 zensical, compat – support anchor redirects

Bug fixes

• 6910d56 compat – relax validation of autorefs settings
• eac9e24 ui – update ui to v0.0.29
• 78a34cd zensical-serve – avoid port conflicts in server doctests
• 304e280 compat – relax search validation (#​926)

Refactorings

• 6220f43 zensical – clarify redirect planning and output

mrmans0n/compose-rules (io.nlopez.compose.rules:detekt)

v0.6.6

What's changed

• Exempt previews from non-restartable rule (#​697) @​mrmans0n
• Update pymdown-extensions (#​695) @​mrmans0n

Dependency Matrix

linter	version	kotlin version
detekt	2.0.0-alpha.6	2.4.10
ktlint	1.8.0	2.2.21

v0.6.5

A new few rules!

• UnnecessaryLaunchedEffect will pester you in Compose 1.12+ if you use a LaunchedEffect and nothing in it is suspend. You can configure known exemptions, if you have some effects where timing matters and you'd prefer to keep using LaunchedEffect on them (e.g. FocusRequester interactions are sensible to this).
• MissingNonRestartableComposable for pass through Composables that not need restarting.

What's changed

• Add UnnecessaryLaunchedEffect rule (#​693) @​mrmans0n
• Add MissingNonRestartableComposable (#​694) @​mrmans0n
• Update plugin spotless to v8.10.1 - autoclosed (#​691) @​renovate[bot]
• Update dependency org.yaml:snakeyaml to v2.7 (#​692) @​renovate[bot]
• Update actions/setup-java action to v6 (#​690) @​renovate[bot]
• Update Gradle to v9.7.1 (#​689) @​renovate[bot]
• Update plugin spotless to v8.10.0 (#​688) @​renovate[bot]
• Update astral-sh/setup-uv action to v10.0.1 (#​687) @​renovate[bot]
• Update dependency androidx.compose:compose-bom to v2026.08.00 (#​685) @​renovate[bot]
• Update astral-sh/setup-uv action to v10 (#​686) @​renovate[bot]
• Update Gradle to v9.7.0 (#​683) @​renovate[bot]

Dependency Matrix

linter	version	kotlin version
detekt	2.0.0-alpha.6	2.4.10
ktlint	1.8.0	2.2.21

v0.6.4: 0.6.4

What's Changed

• Ignore unsigned integer literals for autoboxing checks by @​mrmans0n in #​677
• Update plugin shadowJar to v9.6.1 by @​renovate[bot] in #​679
• Update astral-sh/setup-uv action to v9 by @​renovate[bot] in #​678
• Update plugin spotless to v8.9.0 by @​renovate[bot] in #​680
• Update detekt to 2.0.0-alpha.6 by @​mrmans0n in #​682

Full Changelog: mrmans0n/compose-rules@v0.6.3...v0.6.4

Dependency Matrix

linter	version	kotlin version
detekt	2.0.0-alpha.6	2.4.10
ktlint	1.8.0	2.2.21

ktorio/ktor (io.ktor:ktor-bom)

v3.6.0

Compare Source

Published 16 September 2026

Features

• KTOR-8596 OpenID Connect (OAuth2) auto-discover & configuration
• KTOR-9645 Client curated multi-platform facade module
• KTOR-8883 Support nested jars in static resources
• KTOR-8672 Support at least zstd and deflate formats of precompressed files
• KTOR-8595 Auth JWK Support (auto-discover)
• KTOR-9841 OIDC Server Plugin
• KTOR-9654 Override fetch in JS engine
• KTOR-9785 Typesafe Authentication DSL
• KTOR-462 Async CIO DNS resolver with timeout
• KTOR-9709 Add resource attribute for client resources plugin
• KTOR-5009 ContentNegotiation: Add a way to prevent changing Accept and Content-Type headers
• KTOR-9776 OpenAPI: Support the "const" validation keyword
• KTOR-7468 DefaultConversionService: Support Uuid type introduced in Kotlin 2.0
• KTOR-9578 HttpCache add method for clearing
• KTOR-9590 OpenAPI Contextual JSON schema inference support
• KTOR-6610 Log which ConfigLoader has been used for loading the server configuration
• KTOR-9735 Commonize HttpCache FileCacheStorage
• KTOR-8953 WebRTC client on JVM
• KTOR-9674 UDP support for Node.js targets
• KTOR-9612 Add text/markdown to the ContentType constants

Improvements

• KTOR-9876 Typo in KDoc for routing function: "for the this Application".
• KTOR-9778 Character classification in ktor-http hot paths uses boxed Set lookups and per-symbol encoder allocations
• KTOR-9702 Duplicate code in ByteReadChannel
• KTOR-9716 Make ApplicationCallPipeline.ApplicationPhase.Validators public in 3.6.0
• KTOR-9734 Use TagConsumer in respondHtmlFragment lambda receiver
• KTOR-5577 Support nullable types in ApplicationCall.receive
• KTOR-2367 OAuth: clients expect to get authenticated once per "session" for all protected routes
• KTOR-8594 Auth: Non-optional principal is of nullable type
• KTOR-9816 Escape $ in application.yaml file
• KTOR-8193 Unnecessary blocking in OutputStream wrapper

Bugfixes

• KTOR-8705 testApplication: call coroutine context isn't preserved when responding with ChannelWriterContent
• KTOR-9248 JWTAuthenticationProvider silently swallows exceptions
• KTOR-9892 Digest Auth client: nc and qop are not handled according to RFC 7616
• KTOR-9891 CIO on Kotlin/Native collapses above ~50 connections: HttpHeadersMap pools contend on an allocating SynchronizedObject
• KTOR-9794 Digest Auth: NullPointerException when the server does not expect Digest auth
• KTOR-9788 Netty: engine double-responds after its built-in 400, crashing the call-handler coroutine with "Headers can no longer be set because response was already completed"
• KTOR-9834 HttpClient eagerly initializes SLF4J during Android startup
• KTOR-9701 Jackson/Gson converters waste time on unnecessary Dispatchers.IO dispatch
• KTOR-9832 Apache5: Upgrading Apache HttpClient5 to version 5.6 breaks the Ktor client with Content-Length mismatch error for any gzipped content
• KTOR-9870 OkHttp: Reduce coroutine dispatching and allocations while reading response bodies
• KTOR-9627 Cancel blocking bridges when coroutine is cancelled
• KTOR-7067 Ktor Cookie.parseClientCookiesHeader returns Map, which breaks Cookie header contract
• KTOR-9643 Allow H2C and HTTP/2 on same server
• KTOR-9302 OpenAPI: No way to set tag description
• KTOR-9827 Authorization header removed from refresh token request
• KTOR-8355 Bad percentage encoding in URL query causes uncaught exception and 500 status
• KTOR-9762 Android: can hang when cancelling a streaming response during a blocking read
• KTOR-9443 OpenAPI: "No mapping for symbol: VALUE_PARAMETER" exception when respondText receives a conditional ContentType within ApplicationCall extension function
• KTOR-9392 OpenAPI: "No mapping for symbol: VAR name" exception when code inference is on
• KTOR-9389 OpenAPI: "IllegalStateException: No mapping for symbol" when code inference and passing received body to HttpStatusCode()
• KTOR-9784 Multipart is not supported on non-JVM server targets
• KTOR-9657 OpenAPI: generated schema for recursive types uses invalid schemaRef with ReflectionJsonSchemaInference
• KTOR-9676 Incorrect warning about streaming compression buffering
• KTOR-9712 Netty HTTP/3: the listener can only ever serve ONE QUIC connection — every subsequent handshake times out
• KTOR-9386 Misleading log output for Unix Domain Socket servers: "Responding at unix://0.0.0.0:80"
• KTOR-8755 CIO: The engine doesn't encode Unicode symbols like '–' (U+2013) in request URL
• KTOR-9513 CharsetDecoder.decode() ignores the max argument on JVM
• KTOR-9825 Unescape quoted-pair at the end of a header parameter value
• KTOR-9731 CIO: HttpRequestLifecycle cancels Connection: close call too soon, sending an incomplete response
• KTOR-9770 CIO: mapToKtor unwraps non-timeout exceptions to their cause
• KTOR-9772 Make quality parameter case-insensitive
• KTOR-9773 OkHttp: Cancelling a request can close the response body on the Android main thread
• KTOR-7009 CIO: "Failed to parse HTTP response: unexpected EOF" when pipelining is on
• KTOR-9819 Curl: Requests leak curl_slist and response StableRef
• KTOR-9761 CIO server: request handler can leak when idle timeout cancels a claimed response
• KTOR-9817 Darwin CertificatePinner over-releases borrowed Core Foundation references
• KTOR-9774 CIO: pipelining corrupts requests with non-empty bodies
• KTOR-9766 OpenAPI: "has no continuation" AssertionError when a suspend call inside a sealed-type branch reads the smart-cast value
• KTOR-9775 OkHttp: duplex streaming does not release the connection after the request completes
• KTOR-9722 DigestAuthProvider cannot be initialized with a congested Dispatchers.Default pool
• KTOR-9739 Outdated KDoc for AuthProvider.refreshToken method
• KTOR-9792 Application lifecycle events affect other reload generations
• KTOR-9793 The new DI scope is cancelled during hot reload
• KTOR-9648 OpenAPI: reflection schema inference produces incorrect discriminator mapping for Jackson-annotated and nested sealed hierarchies
• KTOR-9760 Digest Auth: URI and HA2 are empty for a URL without a path
• KTOR-9705 OpenAPI UI (ktor-server-openapi) does not support OpenAPI spec 3.1.*
• KTOR-9715 Netty HTTP/3: user handler code is dispatched on the QUIC event loop — one blocking handler freezes the entire HTTP/3 listener (callEventGroup / pinnedCallExecutor not used)
• KTOR-2912 CORS Plugin: Access-Control-Allow-Methods header does not include default methods (GET, POST, HEAD)
• KTOR-9526 Static Content: excluded extension prevents fallback, and index file bypasses exclusion rules
• KTOR-9523 OAuth2: fallback handler not invoked when token endpoint returns invalid_grant
• KTOR-9501 Websockets: Closing WebSocketSession with a long message leads to ProtocolViolationException
• KTOR-9561 ByteReadChannel.copyTo does not propagate source closedCause on normal exit
• KTOR-9640 ktor-io reader/writer ignores autoFlush
• KTOR-9889 DI: Concurrent module loading can cause a deadlock
• KTOR-9886 Netty: inverted skippedRead CAS leaves runningLimit read-resumption broken; runningLimit = 1 deadlocks keep-alive connections

v3.5.2

Compare Source

Published 31 July 2026

Improvements

• KTOR-8032 RateLimit: Allow limit requests based on authentication result
• KTOR-9719 ApplicationCall.isStaticContent returns false when called from plugin interceptors
• KTOR-8450 ContentNegotiation: it doesn't handle content type suffixes
• KTOR-7892 SwaggerUI: Missing oauth2-redirect.html support in the plugin
• KTOR-9759 Reject whitespace in URL hosts during parsing
• KTOR-9681 Update kotlinx-io to 0.9.1
• KTOR-9743 ByteReadChannel.readLineStrict: Misleading definition of limit parameter in KDocs
• KTOR-9504 Improve KDoc for EmbeddedServer.addShutdownHook

Bugfixes

• KTOR-9741 CIO: request-handler coroutine leak on half-closed idle connection after ≥1MB response
• KTOR-7661 Maven + YAML config file does not work
• KTOR-9585 OpenAPI: JsonSchema title is truncated when it contains a dot
• KTOR-9704 UTF-8 encoding in ktor-io bypasses JVM String.getBytes intrinsics, slowing every text response by 5-7x
• KTOR-9588 SSE client (CIO engine) sends spurious Content-Length: 0 on body-less GET (RFC 9110 § 8.6 violation; rejected by AWS ELB)
• KTOR-9679 ByteReadChannel.readLine corrupts multi-byte UTF-8 by splitting a character at a buffer boundary
• KTOR-9767 ByteReadChannel.readLineTo: Return read bytes count instead of decoded characters count
• KTOR-8992 HoconConfigLoader is not loaded when ktor-server-config-yaml on the classpath
• KTOR-9698 OpenAPI: schema for kotlinx.serialization sealed types omits discriminator property in variant schemas
• KTOR-9690 Netty: in-flight requests are aborted on stop(), ignoring shutdown grace period
• KTOR-8903 Netty: Close channel connection on errors properly
• KTOR-9707 SaveBody performance regression
• KTOR-9703 Inefficient text reading function in DefaultTransform
• KTOR-9711 Netty HTTP/2: a single client-canceled stream (RST_STREAM) breaks response flushing for the whole connection
• KTOR-9688 RateLimit: No access to principal when wrapped with authentication since 3.5.1
• KTOR-9677 Auto-reloading: server is reloaded only once since 3.5.0
• KTOR-9683 Sockets: Canceling a SelectorManager job doesn't close it properly
• KTOR-9671 Darwin: Semicolons in URL path are sanitized

google/ksp (com.google.devtools.ksp)

v2.3.12

Compare Source

What's Changed

Migrating Processors to Support Backing Fields

This release introduces support for explicit backing fields (#​2873), which may now be returned by Resolver.getSymbolsWithAnnotation. To prevent breaking existing processors, new language features require an explicit opt-in.

More generally, the KSP API now explicitly models backing fields for properties. The following is an exhaustive list of functions in KSP API where processor may observe the change after opting in:

• Resolver.getSymbolsWithAnnotation: The function now returns a KSBackingField if the given annotation targeted a field. Previously, if a field were targeted, the function would return a KSProperty.
• Resolver.effectiveJavaModifiers: The function returns fewer modifiers for a KSPropertyDeclaration if it has a backing field, since most of the JVM-specific annotations apply to the backing field. If you are interested in the JVM modifiers, you should call the function with the KSBackingField obtained from the property instead.

Additionally, KSP now models Java fields as properties that always have backing fields. Some of the modifiers now apply to the backing field instead.

Processors adapting to new features must opt in via both of the following steps simultaneously (failing to do both may lead to undefined behavior):

1. The processor should call the registerProcessorForNewFeatures function in SymbolProcessorEnvironment immediately when created (and only once). Example: [AbstractTestProcessor.kt#L30](https://redirect.github.com/google/ksp/blob/958be42

❗ Important

✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At 10:00 PM through 11:59 PM and 12:00 AM through 04:59 AM (* 22-23,0-4 * * *)
  • Only on Sunday and Saturday (* * * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.