⬆️ Update all dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change	Age	Adoption	Passing	Confidence
gradle (source)		minor	9.4.1 → 9.5.1
dev.drewhamilton.poko	plugin	patch	0.22.0 → 0.22.1
io.nlopez.compose.rules:detekt	dependencies	patch	0.5.6 → 0.5.8
io.ktor:ktor-bom	dependencies	minor	3.4.1 → 3.5.0
com.google.devtools.ksp (source)	plugin	patch	2.3.6 → 2.3.8
com.google.devtools.ksp:com.google.devtools.ksp.gradle.plugin (source)	dependencies	patch	2.3.6 → 2.3.8
io.kotest	plugin	patch	6.1.7 → 6.1.11
io.kotest:kotest-bom	dependencies	patch	6.1.7 → 6.1.11
io.insert-koin:koin-bom (source)	dependencies	patch	4.2.0 → 4.2.1
org.jetbrains.dokka	plugin	minor	2.1.0 → 2.2.0
dev.detekt	plugin	patch	2.0.0-alpha.2 → 2.0.0-alpha.3
dev.detekt:detekt-gradle-plugin (source)	dependencies	patch	2.0.0-alpha.2 → 2.0.0-alpha.3
dev.detekt:detekt-rules-ruleauthors (source)	dependencies	patch	2.0.0-alpha.2 → 2.0.0-alpha.3
dev.detekt:detekt-rules-libraries (source)	dependencies	patch	2.0.0-alpha.2 → 2.0.0-alpha.3
dev.detekt:detekt-rules-ktlint-wrapper (source)	dependencies	patch	2.0.0-alpha.2 → 2.0.0-alpha.3
dev.detekt:detekt-cli (source)	dependencies	patch	2.0.0-alpha.2 → 2.0.0-alpha.3
dev.detekt:detekt-api (source)	dependencies	patch	2.0.0-alpha.2 → 2.0.0-alpha.3
com.android.compose.screenshot (source)	plugin	patch	0.0.1-alpha13 → 0.0.1-alpha14
com.android.tools.screenshot:screenshot-validation-api	dependencies	patch	0.0.1-alpha13 → 0.0.1-alpha14
androidx.navigation:navigation-compose (source)	dependencies	patch	2.9.7 → 2.9.8
androidx.compose:compose-bom	dependencies	minor	2026.03.00 → 2026.05.00
com.android.tools:common (source)	dependencies	minor	32.1.0 → 32.2.1
com.android.kotlin.multiplatform.library (source)	plugin	minor	9.1.0 → 9.2.1
com.android.library (source)	plugin	minor	9.1.0 → 9.2.1
com.android.application (source)	plugin	minor	9.1.0 → 9.2.1
com.android.tools.build:gradle (source)	dependencies	minor	9.1.0 → 9.2.1

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

gradle/gradle (gradle)

v9.5.1

Compare Source

v9.5.0

Compare Source

drewhamilton/Poko (dev.drewhamilton.poko)

v0.22.1

Compare Source

2026-04-24

Compile with Kotlin 2.3.21. Implement forward compatibility with Kotlin 2.4.0-Beta2.

mrmans0n/compose-rules (io.nlopez.compose.rules:detekt)

v0.5.8: 0.5.8

What's Changed

• Add Material 3 dividers as content emitters by @​alyssoncs in #​613
• Update plugin com.gradle.develocity to v4.4.1 by @​renovate[bot] in #​614
• Update astral-sh/setup-uv action to v8 by @​renovate[bot] in #​615
• Update dependency androidx.compose:compose-bom to v2026.04.01 by @​renovate[bot] in #​616
• Update detekt to 2.0.0-alpha.3 by @​mrmans0n in #​619

New Contributors

• @​alyssoncs made their first contribution in #​613

Dependency Matrix

linter	version	kotlin version
detekt	2.0.0-alpha.3	2.3.21
ktlint	1.8.0	2.2.21

Full Changelog: mrmans0n/compose-rules@v0.5.7...v0.5.8

v0.5.7

What's changed

• Update plugin shadowJar to v9.4.1 (#​611) @​renovate[bot]
• Update dependency androidx.compose:compose-bom to v2026.03.01 (#​609) @​renovate[bot]
• Update plugin com.gradle.develocity to v4.4.0 (#​610) @​renovate[bot]
• Update gradle/actions action to v6 (#​608) @​renovate[bot]
• Update Gradle to v9.4.1 (#​607) @​renovate[bot]
• Update plugin spotless to v8.4.0 (#​606) @​renovate[bot]
• Update plugin shadowJar to v9.4.0 (#​605) @​renovate[bot]
• Update release-drafter/release-drafter action to v7 (#​604) @​renovate[bot]
• Update dependency androidx.compose:compose-bom to v2026.03.00 (#​603) @​renovate[bot]
• Update Gradle to v9.4.0 (#​602) @​renovate[bot]
• Update plugin spotless to v8.3.0 (#​601) @​renovate[bot]
• Update plugin shadowJar to v9.3.2 (#​600) @​renovate[bot]
• Update dependency androidx.compose:compose-bom to v2026.02.01 (#​599) @​renovate[bot]
• Update actions/upload-artifact action to v7 (#​598) @​renovate[bot]
• Update dependency org.yaml:snakeyaml to v2.6 (#​597) @​renovate[bot]
• Update junit-framework monorepo (#​596) @​renovate[bot]
• Update dependency androidx.compose:compose-bom to v2026.02.00 (#​595) @​renovate[bot]
• Fix detekt version matrix: alpha.2 support started in 0.5.6 (#​594) @​mrmans0n
• Update Gradle to v9.3.1 (#​592) @​renovate[bot]
• Update dependency androidx.compose:compose-bom to v2026.01.01 (#​591) @​renovate[bot]
• Update plugin com.gradle.develocity to v4.3.2 (#​590) @​renovate[bot]
• Update plugin spotless to v8.2.1 (#​589) @​renovate[bot]

Dependency Matrix

linter	version	kotlin version
detekt	2.0.0-alpha.2	2.3.0
ktlint	1.8.0	2.2.21

ktorio/ktor (io.ktor:ktor-bom)

v3.5.0

Published 14 May 2026

Features

• KTOR-8421 Route.contentType should support multiple ContentType
• KTOR-7961 Add known TDM headers to the HttpHeaders object
• KTOR-9418 Support getAs from the root ApplicationConfig
• KTOR-9559 DNS configuration for the Apache5 client
• KTOR-9554 DNS configuration for OkHttp client engine
• KTOR-9555 Custom SSE heartbeat function
• KTOR-8914 Dependency injection: read annotations in function references
• KTOR-8300 Sessions: Add a way to create a user session shared for all user devices or look up sessions of the same user
• KTOR-9521 Upgrade to Kotlin 2.3.21
• KTOR-9276 Make DynamicProviderConfig.authenticateFunction suspend
• KTOR-9491 Provide parameter validation convenience functions
• KTOR-9506 OpenAPI: Support prefixItems in JsonSchema for tuple type definitions
• KTOR-470 Add an option to not resend the session cookie if the session data wasn't changed.
• KTOR-9355 Deprecate HttpHeaders.AcceptCharset
• KTOR-7659 Make ktor-network compatible with ES modules for nodejs
• KTOR-9350 JS: Make ES2015 the default target for tests
• KTOR-7578 Update Digest authentication implementation according to RFC 7616

Improvements

• KTOR-9503 The JacksonConverter.streamRequestBody property name is confusing
• KTOR-9552 Deprecation notice for io.ktor.server.auth.Principal does not explain what to use instead
• KTOR-7458 Jetty Jakarta: Provide an easy way to disable SNI hostname validation
• KTOR-9354 Websockets: webSocket builder function should return a Route to be describable
• KTOR-9488 Nonce and hex function performance optimizations

Bugfixes

• KTOR-9524 Netty response hangs after connection lost
• KTOR-9542 Netty: The request handler runs on worker event loop instead of call event loop since 3.4.3
• KTOR-9531 Netty server intermittently drops requests after upgrading to 3.4.3
• KTOR-8151 MicrometerMetrics: "MeterFilters configured after a Meter has been registered" warning when a metric is registered before installing the plugin
• KTOR-9411 Darwin throws DarwinHttpRequestException instead of FrameTooBigException
• KTOR-8320 CallLogging: plugin usage in testApplication breaks console standard output
• KTOR-8906 Jackson, with request body streaming on, exhausts Dispatchers.IO
• KTOR-8709 Websockets: Unable to close session with a custom CloseReason
• KTOR-9567 Flaky UnixSockets on Windows: WSAEOPNOTSUPP from bind()
• KTOR-9183 A client call wrapped with withTimeout throws a generic CancellationException instead of TimeoutCancellationException
• KTOR-8199 Autoreloading: default watch patterns don't match anything when project path contain spaces
• KTOR-9549 Kotlin/JS: ktor-ktor-client-core.mjs is incompatible with Vite: toRaw naming conflict
• KTOR-9544 Apache: body channel not cancelled when caller scope is cancelled
• KTOR-9546 HttpClient: cancelling ByteReadChannel body does not propagate to engine
• KTOR-455 Content-Disposition additional parameters should be inside quotes
• KTOR-9500 RawSourceChannel returns false positive on awaitContent
• KTOR-646 Netty engine still print annoying exceptions
• KTOR-9527 Curl: Freeze when receiving large responses
• KTOR-9460 Curl: Can't build shared library with Ktor 3.4.2
• KTOR-9483 Curl: backpressure implementation is never used
• KTOR-9545 Curl: body channel not cancelled when caller scope is cancelled
• KTOR-9540 Curl: CancelWebSocket task may cancel a new HTTP request due to easy handle pointer reuse
• KTOR-9539 Curl: WebSocket bearer token refresh fails due to stale native handle reuse
• KTOR-9536 Netty call hang when channel becomes inactive before response is sent
• KTOR-4752 OkHttp: Websockets pinging doesn't work
• KTOR-9409 call.respond performance regression caused by transitive kotlin-reflect:2.3.0
• KTOR-9487 ZSTD decoder fails if the compressed frame is larger than 4096 bytes
• KTOR-8271 MockEngine, HttpTimeout: the virtual clock of kotlinx coroutines isn't respected
• KTOR-6683 Plugin onCallReceive/transformBody is not called for receive()
• KTOR-7416 Jetty, Java: Custom Host header doesn't override the default value
• KTOR-9203 CIOMultipartDataBase: Call thread is blocked when releasing file parts

v3.4.3

Compare Source

Published 22 April 2026

Bugfixes

• KTOR-9451 OpenAPI schema inference not working for custom nested generics
• KTOR-9490 OpenAPI: Self-referential schema $ref uses FQN while schema is registered with a simple name
• KTOR-9463 OpenAPI: schema inference StackOverflow
• KTOR-8938 WebSockets: WebSockets handler does not inherit server coroutine context
• KTOR-8989 Shared engine is closed when a client created with config method is closed
• KTOR-9485 Apache5: FutureCallback never called, breaking Java agent instrumentation
• KTOR-9497 Darwin: SIGABRT crash when close() races with in-flight execute() since 3.4.2
• KTOR-9431 SuspendFunctionGun: ThreadContextElement leaks across requests when interceptor suspends
• KTOR-9423 CannotTransformContentToTypeException leaks internal class names in response body
• KTOR-9461 Incorrect link to the OWASP cheatsheet in the KDoc for CSRF plugin
• KTOR-9476 Unable to update/remove session data if no response content
• KTOR-9343 HttpRequestLifecycle plugin with cancelCallOnClose on, cancels subsequent requests when CallLogging plugin with callIdMdc is installed

v3.4.2

Compare Source

Published 27 March 2026

Improvements

• KTOR-9327 Curl: The WebSockets maxFrameSize option does not have an effect
• KTOR-9383 CaseInsensitiveString: reduce allocations
• KTOR-9385 Netty: Allocation micro-optimizations
• KTOR-9403 Darwin: Unnecessary ByteArray copy for each received response chunk
• KTOR-9412 KDoc for formFieldLimit documents incorrect default value (64 KB instead of 50 MiB)

Bugfixes

• KTOR-9351 OpenAPI: Incorrect schema generated for nested classes with lists
• KTOR-9361 WebSockets: JsWebSocketSession._closeReason is completed twice
• KTOR-9437 Fix GraalVM Compatibility
• KTOR-9424 Logging: OkHttp format should log the full requested URL
• KTOR-8540 Logging: IllegalStateException is thrown when response is cached and deserialization fails
• KTOR-9370 OpenAPI: NoSuchMethodError - getLOCAL_FUNCTION_FOR_LAMBDA with Kotlin 2.3.20-*
• KTOR-9421 Netty: active SSE connection blocks HTTP/2 response flushing for other requests
• KTOR-3390 JS browser: "Failed to execute 'digest' on 'SubtleCrypto'" error when using digest auth
• KTOR-5977 Compression: The encoders buffer streaming response
• KTOR-9393 Certificate pinning matches against all pins instead of hostname-scoped pins
• KTOR-8751 DI: AmbiguousDependencyException when named dependency is overridden in testApplication
• KTOR-9039 Bearer Auth: Request body transformed with jsonIO isn't sent over again after refreshToken request
• KTOR-9404 Darwin: Memory leak in KtorNSURLSessionDelegate
• KTOR-9399 LinkageError when running Ktor app with development mode inside Spring Boot / Amper fat-JAR
• KTOR-9402 NoSuchMethodError on RawWebSocket after 3.4.0
• KTOR-9372 Frame.Text.readText() causes infinite loop and 100% CPU on Kotlin/Native when WebSocket frame data is malformed or connection drops unexpectedly
• KTOR-9387 ZstdEncoder decode fails when source data is split into multiple Zstd frames

google/ksp (com.google.devtools.ksp)

v2.3.8

Compare Source

What's Changed

• Enabled new default annotation use-site rules in Kotlin's Analysis API (see KEEP 402) for more information. Note: KSP was already mostly compatible with KEEP 402, so there shouldn't be any visible changes for users. (#​2888)
• Enabled ksp.project.isolation by default when Gradle isolated projects are enabled (#​2866)
• Improved getSymbolsWithAnnotation performance by implementing a new PSI-based resolution strategy (#​2816)

Contributors

• Thanks to @​hugoncosta made and everyone who reported bugs and participated in discussions!

Full Changelog: google/ksp@2.3.7...2.3.8

v2.3.7

Compare Source

What's Changed

• Bumped Kotlin target language version to 2.3 (#​2821)
• Fixed crash caused by upstream dependency (#​2856)
• Fixed support for Gradle Isolated Projects (#​2844)

Contributors

• Thanks to everyone who reported bugs and participated in discussions!

Full Changelog: google/ksp@2.3.6...2.3.7

kotest/kotest (io.kotest:kotest-bom)

v6.1.11

Compare Source

What's Changed

• Fix native IR crash from shadowed OnlyInputTypes (#​5821) by @​PreAgile in #​5828
• Fix wasmJsD8Test timeout failure when tests use delay() by @​sksamuel in #​5827

Full Changelog: kotest/kotest@v6.1.10...6.1.11

v6.1.10

Compare Source

What's Changed

• Test Result Gutters by @​alfonsoristorato in #​5684
• Add tests confirming DSL callback ordering relative to annotation and project config listeners by @​sksamuel in #​5800
• Fix import alias clash when spec name digits concatenate with index digits by @​sksamuel in #​5802
• Fix PackageRunConfigurationProducer shouldReplace/isPreferredConfiguration over spec configs (#​5652) by @​sksamuel in #​5803
• Fix Kotest engine skipping discovery when AGP 9+ passes MethodSelectors (#​5773) by @​sksamuel in #​5804
• Add custom Json parser support to JSON matchers by @​PreAgile in #​5795
• Set KOTEST_IDEA_PLUGIN=true in Gradle and Android run producers by @​sksamuel in #​5808
• Add JVM_SUITE_NAME env var for Allure suite grouping (#​4573) by @​sksamuel in #​5792
• Add type-safe shouldEq / shouldNotEq assertions by @​PreAgile in #​5789
• AI Agent kotest skill by @​alfonsoristorato in #​5754
• speed-up-containExactly by @​AlexCue987 in #​5812
• docs: add AI-ready configuration for coding assistants by @​lunacompsia-oss in #​5810
• Fix JS engine mocha race: single channel send in engineFinished by @​sksamuel in #​5809
• Add anyOf/oneOf support to JsonSchema DSL and parser (#​4463) by @​PreAgile in #​5807
• Update shouldContainInOrder to find best matches by @​AlexCue987 in #​5817

New Contributors

• @​lunacompsia-oss made their first contribution in #​5810

Full Changelog: kotest/kotest@v6.1.9...v6.1.10

v6.1.9

Compare Source

Full Changelog: kotest/kotest@v6.1.8...v6.1.9

The Gradle 9.4 --tests filter change was missed from the 6.1.8 release.
This 6.1.9 release includes it.

If you are using Gradle 9.4+ then you need this build to run a single test from the IDE.

v6.1.8

Compare Source

What's Changed

• Precise Gradle configuration needed for pitest extension by @​szpak in #​5748
• Add automatic JUnit4 @​Rule support to KotestTestRunner by @​sksamuel in #​5749
• Follow up to #​5704 to clean filters at execution time not configuration time by @​sksamuel in #​5751
• ci: add workflow to auto-update API dumps on PR failures by @​Kantis in #​5757
• Update JsTestFrameworkTestEngineListener to handle nested tests correctly. by @​sksamuel in #​5752
• Enabling update-api-dump for PRs from forks by @​Kantis in #​5760
• Make shouldHaveSingleElement and shouldNotHaveSingleElement chainable by @​PreAgile in #​5756
• Fix ProhibitedAnalysisException when re-running failed tests by @​sksamuel in #​5766
• Add JSON Schema prefixItems (tuple validation) and enum support by @​sksamuel in #​5771
• Add primitive array support for contain matcher (#​4354) by @​sksamuel in #​5775
• Add JS lifecycle order test for issue #​3340 by @​sksamuel in #​5767
• Mark AnnotationSpec lifecycle methods as implicitly used by @​sksamuel in #​5768
• Support @​Suppress for duplicated test name and focus-in-nested-test warnings by @​sksamuel in #​5769
• Fix withClue clue context not included in assertion errors on non-JVM platforms by @​sksamuel in #​5770
• re-add support for gradle test filters after gradle 9.4.0 by @​alfonsoristorato in #​5785
• Add primitive array support for sorted (shouldBeSorted) matcher (#​4354) by @​sksamuel in #​5781
• Fix Slow Arb.generate for large objects by @​sksamuel in #​5761
• Publish IntelliJ plugin distribution zip to GitHub Packages on master by @​sksamuel in #​5763
• Tidy up logging across the engine and runner by @​sksamuel in #​5787
• Fix typo in SpringExtension by @​T45K in #​5788
• Refactor Discovery to improve class visibility filtering by @​sksamuel in #​5790
• Add tests for leading wildcard class name Gradle filter (#​5639) by @​sksamuel in #​5791
• Add primitive array support for startWith/endWith matchers (#​4354) by @​sksamuel in #​5779
• Add primitive array support for containExactly matcher (#​4354) by @​sksamuel in #​5777
• closing #​5782 : add ClasspathRootSelector support to shouldRunTests g… by @​SimY4 in #​5783
• Add LazyJvmAssertion to avoid stacktraces in inspectors by @​sksamuel in #​5759
• Add primitive array support for beIn (shouldBeIn) matcher (#​4354) by @​sksamuel in #​5780
• Add finalizeSpec DSL function to TestConfiguration and Spec by @​sksamuel in #​5750
• Add tests and fix for afterSpec/beforeSpec in TestFactory (#​4133) by @​sksamuel in #​5786
• Normalize line breaks in test names for Gradle test filters by @​sksamuel in #​5764
• Add primitive array support for inorder (shouldContainInOrder) matcher (#​4354) by @​sksamuel in #​5778
• Add primitive array support for containAll matcher (#​4354) by @​sksamuel in #​5776

New Contributors

• @​PreAgile made their first contribution in #​5756
• @​SimY4 made their first contribution in #​5783

Full Changelog: kotest/kotest@v6.1.7...v6.1.8

InsertKoinIO/koin (io.insert-koin:koin-bom)

v4.2.1: Koin 4.2.1

Compare Source

Support for Compile Safety with Koin Compiler 1.0.0-RC1

• Koin Compiler Plugin 1.0.0-RC1 - https://github.com/InsertKoinIO/koin-compiler-plugin/releases/tag/1.0.0-RC1

Bug Fixes

• Fix stacked-params lookup on linked scopes (#​2387) — The 4.2.0 resolver rewrite (CoreResolverV2) walked linked scopes but dropped the per-parent stacked-parameters check that 4.1.x performed via recursion. This broke patterns where AndroidParametersHolder is stacked on the factory scope by KoinViewModelFactory and SavedStateHandle is then resolved from a child ViewModel scope. Linked-scope resolution now also checks stacked params on each parent scope.

• Restore ABI compatibility for runOnKoinStarted (#​2391) — The 4.2.0 release inadvertently broke binary compatibility for runOnKoinStarted on JVM. Fixed by restoring the original JVM class name via @JvmName/@JvmMultifileClass annotations.

• Fix scope _closed concurrency issue (#​2389) — The Scope._closed flag was not volatile, which could cause stale reads under concurrent access.

Improvements

• Improved Scope resolution error messages — CoreResolverV2 now provides clearer error messages when scope resolution fails, making it easier to diagnose misconfigured scopes.

• Added apiCheck to CI — Binary compatibility validation (kotlinx.binary-compatibility-validator) now runs on every PR to prevent future ABI breaks.

Documentation

• parametersOf type-collision warning (#​2328) — Added a caution note explaining that when a value passed via parametersOf has the same type as the requested definition, Koin returns the value directly and skips the factory block. Suggests using a wrapper type as a workaround.

Contributors

Thanks to the following contributors for this release:

• @​arnaudgiuliani (Arnaud Giuliani)
• @​inemtsev (Ilya Nemtsev) — fix for scope closed concurrency issue (#​2389)

detekt/detekt (dev.detekt:detekt-gradle-plugin)

v2.0.0-alpha.3

2.0.0-alpha.3 - 2026-04-24

This is an alpha release of Detekt 2.0.0. Is built against Kotlin 2.3.21, Gradle 9.3.1, AGP 9.1.1 and is tested against JDK 25.

As of this release, the workaround of disabling the new DSL and built-in Kotlin via gradle.properties for AGP 9.x projects is no longer required.

Notable Changes

• Bump Kotlin to v2.3.21 - #​9272
• Bump AGP to v9.1.1 - #​9244
• Add support for AGP 9 built-in Kotlin - #​9100
• Rule UnnecessaryFullyQualifiedName now requires full mode to run - #​9061
• Add new rule: UnnecessaryRun - #​7428

Breaking Changes

• Remove DetektProgressListener from our public API - #​9221
• Remove InvalidConfigurationError from our public API - #​8994

Changelog

• UseOrEmpty - Fix AA type leaks - #​9263
• ForbiddenNamedParam - Fix AA type leaks - #​9262
• UnusedVariable - Fix AA type leaks - #​9260
• UnnecessaryNotNullOperator - Fix AA type leaks - #​9259
• Deprecation - Fix AA type leaks - #​9258
• NestedScopeFunctions - Fix AA type leaks - #​9257
• Suggest similar property names for misspelled config properties - #​9250
• MagicNumber DslGradleRunner test fix - #​9245
• Don't forbid use of java.lang.annotation.Inherited annotation by default - #​9224
• Fixes #​9017 - false positive with name collisions - #​9223
• Optimize

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At 10:00 PM through 11:59 PM and 12:00 AM through 04:59 AM (* 22-23,0-4 * * *)
  • Only on Sunday and Saturday (* * * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.