gradle(deps): bump the gradle-all group across 1 directory with 4 updates

[dependabot]

Bumps the gradle-all group with 4 updates in the / directory: org.jetbrains.kotlinx:kotlinx-io-core, io.ktor:ktor-version-catalog, gradle-wrapper and ch.qos.logback:logback-classic.

Updates org.jetbrains.kotlinx:kotlinx-io-core from 0.9.0 to 0.9.1

Release notes

Sourced from org.jetbrains.kotlinx:kotlinx-io-core's releases.

v0.9.1

Features

• Dropped an old workaround for unsupported Android version #508
• Reimplemented module loading for WasmJs #506

Thanks to @​ilgonmic and @​MohammedKHC for their contributions!

Changelog

Sourced from org.jetbrains.kotlinx:kotlinx-io-core's changelog.

0.9.1

Published 26 June 2026

Features

• Dropped an old workaround for unsupported Android version #508
• Reimplemented module loading for WasmJs #506

Commits

• 362bdc3 Release 0.9.1
• e5ae2f0 Merge branch 'develop'
• 2997caf Drop workaround for Android 4.2.2 getsockname bug (#508)
• a1d6bd9 Use IIFE to asynchronously load a module instead of globalThis (#506)
• d53d449 Update feedback channels in contributing guidelines
• 34f1579 Merge branch 'develop'
• 82caeb2 Document segment pool configuration (#494)
• See full diff in compare view

Updates io.ktor:ktor-version-catalog from 3.4.3 to 3.5.1

Release notes

Sourced from io.ktor:ktor-version-catalog's releases.

3.5.0

Published 14 May 2026

Features

• KTOR-8421 Route.contentType should support multiple ContentType
• KTOR-7961 Add known TDM headers to the HttpHeaders object
• KTOR-9418 Support getAs from the root ApplicationConfig
• KTOR-9559 DNS configuration for the Apache5 client
• KTOR-9554 DNS configuration for OkHttp client engine
• KTOR-9555 Custom SSE heartbeat function
• KTOR-8914 Dependency injection: read annotations in function references
• KTOR-8300 Sessions: Add a way to create a user session shared for all user devices or look up sessions of the same user
• KTOR-9521 Upgrade to Kotlin 2.3.21
• KTOR-9276 Make DynamicProviderConfig.authenticateFunction suspend
• KTOR-9491 Provide parameter validation convenience functions
• KTOR-9506 OpenAPI: Support prefixItems in JsonSchema for tuple type definitions
• KTOR-470 Add an option to not resend the session cookie if the session data wasn't changed.
• KTOR-9355 Deprecate HttpHeaders.AcceptCharset
• KTOR-7659 Make ktor-network compatible with ES modules for nodejs
• KTOR-9350 JS: Make ES2015 the default target for tests
• KTOR-7578 Update Digest authentication implementation according to RFC 7616

Improvements

• KTOR-9503 The JacksonConverter.streamRequestBody property name is confusing
• KTOR-9552 Deprecation notice for io.ktor.server.auth.Principal does not explain what to use instead
• KTOR-7458 Jetty Jakarta: Provide an easy way to disable SNI hostname validation
• KTOR-9354 Websockets: webSocket builder function should return a Route to be describable
• KTOR-9488 Nonce and hex function performance optimizations

Bugfixes

• KTOR-9524 Netty response hangs after connection lost
• KTOR-9542 Netty: The request handler runs on worker event loop instead of call event loop since 3.4.3
• KTOR-9531 Netty server intermittently drops requests after upgrading to 3.4.3
• KTOR-8151 MicrometerMetrics: "MeterFilters configured after a Meter has been registered" warning when a metric is registered before installing the plugin
• KTOR-9411 Darwin throws DarwinHttpRequestException instead of FrameTooBigException
• KTOR-8320 CallLogging: plugin usage in testApplication breaks console standard output
• KTOR-8906 Jackson, with request body streaming on, exhausts Dispatchers.IO
• KTOR-8709 Websockets: Unable to close session with a custom CloseReason
• KTOR-9567 Flaky UnixSockets on Windows: WSAEOPNOTSUPP from bind()
• KTOR-9183 A client call wrapped with withTimeout throws a generic CancellationException instead of TimeoutCancellationException
• KTOR-8199 Autoreloading: default watch patterns don't match anything when project path contain spaces
• KTOR-9549 Kotlin/JS: ktor-ktor-client-core.mjs is incompatible with Vite: toRaw naming conflict
• KTOR-9544 Apache: body channel not cancelled when caller scope is cancelled
• KTOR-9546 HttpClient: cancelling ByteReadChannel body does not propagate to engine
• KTOR-455 Content-Disposition additional parameters should be inside quotes
• KTOR-9500 RawSourceChannel returns false positive on awaitContent
• KTOR-646 Netty engine still print annoying exceptions
• KTOR-9527 Curl: Freeze when receiving large responses
• KTOR-9460 Curl: Can't build shared library with Ktor 3.4.2
• KTOR-9483 Curl: backpressure implementation is never used

... (truncated)

Changelog

Sourced from io.ktor:ktor-version-catalog's changelog.

3.5.1

Published 25 June 2026

Improvements

• KTOR-9492 OpenAPI plugin: handle requireXxx functions in compiler plugin
• KTOR-9569 Add more details for KDoc of BearerAuthConfig.sendWithoutRequest
• KTOR-9571 Add KDoc for BearerAuthConfig.realm
• KTOR-9570 Add Kdoc for BearerAuthConfig.refreshTokens

Bugfixes

• KTOR-9646 Fix Kotlin 2.4.0 compiler plugin breaking changes
• KTOR-9585 OpenAPI: JsonSchema title is truncated when it contains a dot
• KTOR-9591 OpenAPI: @JsonClassDiscriminator on sealed types is ignored when generating OpenAPI discriminator schema
• KTOR-9597 OpenAPI: Schema name collisions because@SerialName of sealed subtypes is used as components.schemas key
• KTOR-9601 OpenAPI: nullable @​JvmInline value class loses nullability in generated schema
• KTOR-9620 Some issues related to digest authentication in 3.5.0
• KTOR-9623 Digest Auth: server must respond with one WWW-Authenticate header for each supported algorithm
• KTOR-9624 Digest Auth: "Unsupported charset in digest authentication header" for a charset name in lowercase
• KTOR-9630 Digest Auth: The plugin sends incorrect nonce when server responds with multiple WWW-Authenticate headers
• KTOR-9565 WebRTC: Peer stops receiving messages after a while on iOS
• KTOR-9610 WebRtcPeerConnection::close causes ClosedReceiveChannelException for other peer
• KTOR-9633 WebRTC statistics fetching race condition
• KTOR-9603 Structured concurrency is violated in WebRTC tests
• KTOR-9671 Darwin: Semicolons in URL path are sanitized
• KTOR-9639 Darwin: WebSocket client crashes the process when a PONG arrives after the session is closed
• KTOR-9575 Darwin: findCharset("UTF-16") maps to NSUTF16LittleEndianStringEncoding causing decoding failure for UTF-16 content with BOM
• KTOR-9661 HttpCache: InvalidCacheStateException is thrown on 304 when no cached entry matches varyKeys
• KTOR-9673 Caching always missing with Content Negotiation
• KTOR-9596 HttpTimeout: HttpRequestTimeoutException on any request with runTest and request timeout defined since 3.5.0
• KTOR-9632 HttpRequestBuilder.timeout call removes capabilities set in DefaultRequest
• KTOR-9252 ContentEncoding: Incomplete gzip response causes client/server to hang indefinitely
• KTOR-9670 Compression: The plugin ignores Accept-Encoding q=0 and most-specific matching
• KTOR-9614 Zstd Compression: "Destination buffer is too small" exception for a particular sequence of bytes
• KTOR-9636 CORS plugin drops OPTIONS preflight requests when allowSameOrigin is on
• KTOR-9659 CORS is skipped when the Origin header contains an IPv6 address
• KTOR-9574 ContentNegotiation: The charset of Accept-Charset header is used for response deserialization
• KTOR-9606 KotlinxSerializationConverter: it fails to deserialize an empty channel closed with a delay
• KTOR-9617 OutputStreamContent and WriterContent can exhaust Dispatchers.IO
• KTOR-9629 RawSourceChannel: coroutine cancellation is not propagated to the RawSource
• KTOR-8870 File.readChannel: do not close a non-opened file and ignore closing exceptions
• KTOR-9460 Curl: Can't build shared library with Ktor 3.4.2
• KTOR-9607 Crash on Android 7: NoSuchMethodError getInstanceStrong() since 3.5.0
• KTOR-9595 CIO: The engine imports node:net statically and breaks wasmJsBrowser webpack build
• KTOR-9615 Apache5: The underlying request is not aborted when coroutine Job is cancelled
• KTOR-8443 RoutingBuilder.contentType does not use parameters when matching
• KTOR-9425 SessionTransportTransformerEncrypt init block uses wrong IV size for AES-256 (regression of KTOR-661)
• KTOR-9621 RateLimit plugin is bypassed when the nested authenticate block rejects the request
• KTOR-8766 DI: The close method is called twice on cleanup of AutoCloseable
• KTOR-8695 GMTDate() being offset by 369 years on Windows
• KTOR-9589 Duplicate PROPERTY_SETTER target in @​InternalAPI annotation

... (truncated)

Commits

• 5ba9d6f Release 3.5.1 (#5719)
• a4f145d KTOR-9661 HttpCache: InvalidCacheStateException is thrown on 304 when… (#5701)
• 2caf278 Fix failing :ktor-io:compileDarwinMainKotlinMetadata (#5716)
• 257de90 KTOR-8766 Fix multiple invocations of close from DI
• e77a168 Fix cache misses with content negotiation 3x (#5714)
• ed22950 Make huge post test less huge
• f329069 Update dependency com.github.luben:zstd-jni to v1.5.7-11
• 6ecd072 Update dependency io.swagger.parser.v3:swagger-parser to v2.1.44
• a0534cd Update dependency io.pebbletemplates:pebble to v4.1.2
• 8647e53 Update dependency com.typesafe:config to v1.4.9
• Additional commits viewable in compare view

Updates gradle-wrapper from 9.6.0 to 9.6.1

Release notes

Sourced from gradle-wrapper's releases.

9.6.1

The Gradle team is excited to announce Gradle 9.6.1.

Here are the highlights of this release:

• Improved Configuration Cache hit rates
• Additional CLI rendering options
• Important project hierarchy lookup deprecations

Read the Release Notes

We would like to thank the following community members for their contributions to this release of Gradle: Aharnish Solanki, Benedikt Johannes, Devendra Reddy Pennabadi, Dmytro Rodionov, Dreeam, Elías Hernández Rodríguez, Eng Zer Jun, FinlayRJW, Kamal Kansal, Marcono1234, Nelson Osacky, Philip Wedemann, Ravi, Roberto Perez Alcolea, Ryan Schmitt, Sebastian Schuberth, seunghun.ham, sk-reddy17, Suvrat Acharya, Vedant Madane.

Upgrade instructions

Switch your build to use Gradle 9.6.1 by updating your wrapper:

./gradlew :wrapper --gradle-version=9.6.1 && ./gradlew :wrapper

See the Gradle 9.x upgrade guide to learn about deprecations, breaking changes and other considerations when upgrading.

For Java, Groovy, Kotlin and Android compatibility, see the full compatibility notes.

Reporting problems

If you find a problem with this release, please file a bug on GitHub Issues adhering to our issue guidelines. If you're not sure you're encountering a bug, please use the forum.

We hope you will build happiness with Gradle, and we look forward to your feedback via Twitter or on GitHub.

Commits

• 309d128 Update fixed issues in release notes for 9.6.1 (#38328)
• 040a978 Update fixed issues in release notes for 9.6.1
• e0b8325 Restore --non-interactive flag instead of --interactive/--no-interactive (#38...
• 946f3e6 Limit explicit temp file permission setting to intended use case (#38300)
• 65f8224 Restore --non-interactive flag instead of --interactive/--no-interactive
• e346a5e Adjust CLI flag to configure non-interactive console (#38301)
• 9b53be9 Adjust CLI flag to configure non-interactive console
• 0dd3b53 Limit explicit temp file permission setting to intended use case
• 48e5ac2 Add reproducers
• 25598fd Prepare 9.6.1 patch release (#38293)
• Additional commits viewable in compare view

Updates ch.qos.logback:logback-classic from 1.5.34 to 1.5.37

Release notes

Sourced from ch.qos.logback:logback-classic's releases.

Logback 1.5.37

2026-06-26 Release of logback version 1.5.37

• Given the numerous vulnerabilities related to conditional configuration processing based on the evaluation of Java expressions using the Janino library, support for such expressions has been removed. Users are offered the an online migration service or the element introduced in version 1.5.20. See the relevant documentation for more details.

• A bitwise identical binary of this version can be reproduced by building from source code at commit c1df7f522e648eec7b4ef6a12c8758fec0f00048 associated with the tag v_1.5.37. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.5.36

2026-06-25 Release of logback version 1.5.36

• The 'condition' attribute in <if> elements now reject certain references that are associated with ACE attacks. This issue was reported by "yulate" (yulate531@gmail.com.com) and registered as CVE-2026-13006.

• A bitwise identical binary of this version can be reproduced by building from source code at commit 9b94c37562bf25a6a944146701d42ee6c4eee888 associated with the tag v_1.5.36. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.5.35

026-06-23 Release of logback version 1.5.35

• The 'condition' attribute in <if> elements now rejects unicode escape sequences (\u and \U). This closes a bypass of the existing prohibition on the new operator in Janino-evaluated conditions. This issue was reported by IcySun (icysun@qq.com) and registered as CVE-2026-13006.

• Added ConfiguratorRank.AUTHENTICATING (rank 100), the highest configurator rank, for certified/authenticating configurators discovered via the ServiceLoader mechanism. ContextInitializer now requires that at most one such configurator exist on the classpath; if more than one is found, initialization aborts with an error.

• ConsoleCharsetPropertyDefiner is no longer shipped. The Java 21 multi-release compilation of logback-core has been disabled, which removes this class from the published artifact. Configurations that referenced ch.qos.logback.core.property.ConsoleCharsetPropertyDefiner will need an alternative approach for console charset detection.

• The logback-examples module is now included in artifacts published to Maven Central.

• JoranConfigurator.makeAnotherInstance() and DefaultJoranConfigurator.performMultiStepConfigurationFileSearch() are now protected, allowing derived configurators to override these methods.

• A bitwise identical binary of this version can be reproduced by building from source code at commit 08bd1598d565d83444f72983935e7da4746783b7 associated with the tag v_1.5.35. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Commits

• c1df7f5 prepare release 1.5.37
• a189967 remove conditional based on janino
• aaa9052 start work on 1.5.37-SNAPSHOT
• 9b94c37 prepare release 1.5.36
• e6a8280 prevent attacks using disallowed references
• 24c4b63 start work on 1.5.36-SNAPSHOT
• 08bd159 preapre release 1.5.35
• 37d256b indentation changes only
• d3d7307 minor comment
• fa0411a radomize file location
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions