fix(deps): update dependency org.http4k:http4k-bom to v6.56.0.0

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
org.http4k:http4k-bom (source)	6.12.0.0 → 6.56.0.0

---

Release Notes

http4k/http4k (org.http4k:http4k-bom)

v6.56.0.0

Compare Source

• http4k-*: Upgrade versions
• http4k-testing-webdriver-datastar: [Break] Datastar attributes now use the 1.0 colon separator (e.g. data-on:click, data-bind:foo, data-computed:total) instead of the removed 0.x hyphen form.
• http4k-connect-amazon-dynamodb-fake: [Unlikely Break] UpdateResult.ConditionFailed is now a data class carrying the item to report back, rather than a data object.
• http4k-multipart: [Fix] MultipartFormBody cannot be constructed on read-only filesystems.
• http4k-connect-amazon-dynamodb-fake: [Fix] A conditional DeleteItem is now evaluated. The ConditionExpression was previously ignored outright, so a guarded delete always succeeded against the fake - including inside transactWriteItems, where a failing condition now correctly cancels the transaction.
• http4k-connect-amazon-dynamodb-fake: [Fix] Fake DynamoDB attribute_exists condition for missing item will always succeed for key
• http4k-connect-amazon-dynamodb: PutItem, UpdateItem and DeleteItem gain ReturnValuesOnConditionCheckFailure, so a failed conditional write can return the record which blocked it (DynamoDB reports it in the error body). The enum and TransactWriteItem's support for it already existed.
• http4k-api-openapi: add support for a JSON schema dialect selector in swagger ui. H/T @​dzappold
• http4k-platform-k8s: add k8s server extension for PolyHandler. H/T @​dzappold
• http4k-testing-webdriver - Specify locator name for a better debugging experience H/T @​tamj0rd2

v6.55.0.0

Compare Source

• http4k-*: Upgrade versions including Toon to v2.0.0
• http4k-server-undertow: [Unlikely Break] The request URI is now built from Undertow's raw request target instead of the already-decoded getRelativePath()
• http4k-server-apache: [Unlikely Break] The request path and query are now built from the raw request-target.
• http4k-client-jetty: [Fix] A request carrying both a body and an explicit Content-Length header no longer produces a duplicate Content-Length on the outgoing request.
• http4k-multipart: [Unlikely Break] Nested multipart/mixed parts are now rejected with a ParseError instead of being parsed recursively, bounding parser stack usage on crafted inputs. The unbounded 3-argument StreamingMultipartFormParts.parse overload now applies a default 10MB stream-length cap.
• http4k-core: [Unlikely Break] Cookie values are now percent-encoded on serialization so ;, , and control characters can no longer be interpreted as additional cookie attributes; the same characters are stripped from Domain/Path attributes. Existing quoting of normal values is unchanged.
• http4k-core: [Unlikely Break] DefaultCookieStorage now only accepts a Set-Cookie Domain that domain-matches the origin host, and rejects dotless public-suffix domains (e.g. com), so a response from one host can no longer plant cookies scoped to another. Host-only and exact-host cookies (e.g. localhost, example.co.uk) are unaffected.
• http4k-realtime-core/http4k-ai-mcp-sdk: [Unlikely Break] The HTTP transport now enforces DNS-rebind protection via the new ServerFilters.HttpRebindProtection.
• http4k-connect-mpp/http4k-ai-mcp-mpp: [Break] MppVerifier.verify now receives the server-issued Challenge alongside the Credential, so verifiers can bind the payment to the challenge the server issued (checking id/opaque, expires and single-use), closing a bypass/replay gap. The HTTP, MCP and tool filters now reject a credential whose payment fields (realm/method/intent/request) don't match an offered challenge, before invoking the verifier. A malformed Authorization: Payment header now returns a 402 malformed-credential problem instead of a 500.
• http4k-security-webauthn: [Unlikely Break] Passkeys.passwordless(...) now defaults to userVerification = REQUIRED.
• http4k-core: Hardened docs: extracted path parameters are percent-decoded and may contain /, \ or .., so should be treated as untrusted; clearer warnings on the deliberately-loose ReverseProxyHostMatcher.Contains and on CorsPolicy.UnsafeGlobalPermissive.
• http4k-api-ui-swagger-: [Fix] OAuth URI is not quoted properly
• http4k-core: [Fix] Body.webForm/form parsing no longer truncates field values containing = (e.g. base64 padding); the value is now preserved intact.
• http4k-serverless-lambda: [Fix] The API Gateway V1 and Application Load Balancer adapters now merge multi-value headers/query params.
• http4k-serverless-lambda: [Fix] A request that fails to parse no longer reflects the exception message into the BAD_REQUEST response body.
• http4k-serverless-tencent: [Fix] Requests with no query parameters no longer NPE.
• http4k-serverless-openwhisk: [Fix] An event missing __ow_method now returns NOT_IMPLEMENTED instead of throwing an NPE.
• http4k-connect-x402/http4k-ai-mcp-x402: The payment filters (HTTP + MCP) gain an optional resourceFor lambda; when supplied, a payment is rejected with 402 unless payload.resource matches, so a payment signed for one resource can't be replayed against another. Off by default (standard behaviour unchanged).
• http4k-template-pug4j: The file-backed Caching renderer now applies the same canonical-path containment check as HotReload, rejecting template paths that escape the base directory.
• http4k-core: URLConnectionHttpClient now accepts a BodyMode (defaulting to Memory), allowing responses to be streamed rather than always buffered fully into memory.
• http4k-security-webauthn: Minor hardening and robustness improvements to passkey verification

v6.54.0.0

Compare Source

• http4k-*: Upgrade versions including Pug to v3.0.0
• http4k-template-pug4j: [Breaking] Pug4J upgrade to v3.0.0 now uses a PugEngineBuilder instead of a PugConfiguration. The API is broadly the same (hopefully better!)
• http4k-api-openapi: [Unlikely break] Updated to support OpenApi 3.2.0, with various extra fields such as License and JSON Schema dialect.
• http4k-testing-webdriver-datastar: [New module!] Datastar-enabled WebDriver implementation
• http4k-security-webauthn: [New pro module!] Support for passkeys and passwordless login.
• http4k-core: [Fix] Incorrect gzip content length in streaming mode. H/T @​adamschoenemann
• http4k-core: [Fix] Handle UTF-8 percent-encoding for supplementary-plane characters in URI path segments
• http4k-connect-github: [Fix] HttpGitHub will now properly authorize requests. H/T @​oharaandrew314
• http4k-connect-github: Add GetAuthedUserEmails and GetAuthedUserPublicEmails actions. H/T @​oharaandrew314
• http4k-connect-github-fake: Implement FakeGitHub for all supported actions. H/T @​oharaandrew314
• http4k-connect-ksp-generator: [Fix] Resolve several cases of non-deterministic ksp behaviour, causing extensions to silently fail generation. H/T @​oharaandrew314

v6.53.0.0

Compare Source

• http4k-*: Upgrade versions including Kotlin to 2.4.0
• http4k-testing-webdriver: Http4kWebDriver supports multiple file upload H/T @​savagematt

v6.52.0.0

Compare Source

• http4k-security-digest: [Break] ServerFilters.DigestAuth and DigestAuthProvider now can have a DigestAlgorithm enum (MD5 / SHA_256).
• http4k-ai-a2a-sdk: [Unlikely Break] PushNotificationSender.Http now takes a PushNotificationUrlPolicy.
• http4k-ai-mcp-client: [Unlikely Break] DiscoveredMcpOAuth rejects cross-origin resource_metadata and the legacy auth_server directive from WWW-Authenticate; discovery now falls through to .well-known/oauth-protected-resource at the resource origin.
• http4k-ai-mcp-x402: [Unlikely Break] X402ToolFilter and McpFilters.X402PaymentRequired now take a SettlementMode.
• http4k-api-jsonrpc: [Unlikely Break] RoutingJsonRpcHandler now caps batch requests at 100 elements; oversized batches are rejected with a single Invalid Request error instead of being processed.
• http4k-bridge-micronaut: [Unlikely Break] HttpRequest.asHttp4k() returns null for an unrecognised HTTP method (was IllegalArgumentException); the fallback controller responds with 501 Not Implemented in that case.
• http4k-connect-storage-core: [Unlikely Break] Storage.Disk now canonicalises and containment-checks the key parameter on get/set/remove; keys whose resolved path escapes the configured directory are silently treated as missing.
• http4k-connect-storage-http: [Unlikely Break] Storage.Http now URL-encodes the key before interpolating it into the request path.
• http4k-connect-storage-jdbc: [Fix] Storage.Jdbc now escapes LIKE metacharacters (%, _, \) in keyPrefix, so keySet("%")/removeAll("%") no longer over-match. Implemented via Exposed's LikePattern.ofLiteral.
• http4k-connect-storage-redis: [Fix] Storage.Redis now escapes glob metacharacters (*, ?, [, ], \) in keyPrefix, so keySet("*")/removeAll("*") no longer over-match.
• http4k-multipart: [Unlikely Break] Disk-spilled multipart parts (via DiskLocation.Temp/Permanent) are created with owner-only POSIX permissions where the underlying filesystem supports them.
• http4k-realtime-core: [Unlikely Break] InputStream.chunkedSseSequence() now caps the in-progress message buffer(10 MB by default).
• http4k-security-oauth: [Unlikely Break] AuthServerDiscovery.fromProtectedResource now requires the metadata resource to match the expected resource at a path-segment boundary,
• http4k-server-jetty: [Unlikely Break] WebSocket message aggregation is now capped at 10 MB.
• http4k-server-jetty*: [Unlikely Break] SSE event name and id are now CR/LF-stripped before being written to the wire (matching SseMessage.Event.toMessage()).
• http4k-server-jetty11: [Unlikely Break] WebSocket message aggregation is now capped at 10 MB.
• http4k-server-netty: [Unlikely Break] WebSocket message aggregation is now capped at 10 MB.
• http4k-server-undertow: [Unlikely Break] Default Undertow builder now caps request bodies at 10 MB.
• http4k-serverless-lambda: [Unlikely Break] ApiGatewayV1, ApplicationLoadBalancer, and ApiGatewayRest response adapters now also emit multiValueHeaders, preserving duplicate response headers (e.g. multiple Set-Cookie).
• http4k-webhook: [Unlikely Break] HmacSha256.Signer rejects a WebhookId containing the signing delimiter .; HmacSha256.Verifier returns false for the same.
• http4k-ai-mcp-sdk: [Fix] MCP transports now contain optional CorsPolicy to apply to traffic. Defaults to null to avoid breaking existing usages.
• http4k-ai-mcp-sdk: [Fix] DirectoryResources in Recursive mode no longer permits reading a sibling.
• http4k-connect-storage-core: [Fix] Storage.InMemory().removeAll(keyPrefix) now returns true only when at least one key was actually removed (was returning true whenever the map was non-empty, even if no keys matched the prefix).
• http4k-connect-storage-http: [Fix] Storage.Http().keySet(keyPrefix) no longer returns {""} when the server replies with an empty body; empty lines are filtered out.
• http4k-format-moshi-yaml: [Fix] SnakeYAML is now constructed with SafeConstructor instead of Constructor.
• http4k-multipart: [Fix] multipartIterator() now selects the boundary directive from Content-Type by name.
• http4k-multipart: [Fix] DiskLocation.Temp/Permanent no longer use the multipart filename as the on-disk temp-file prefix.
• http4k-multipart: [Fix] MultipartFormBody.from(...) now closes the underlying DiskLocation on parse failure.
• http4k-realtime-core: [Fix] SseMessage.Data.toMessage() and SseMessage.Event.toMessage() now safer.
• http4k-security-digest: [Fix] DigestCredential.fromHeader no longer throws on an Authorization header containing only the scheme; the request now receives the standard challenge instead of a 500.
• http4k-server-netty: [Fix] A WebSocket-upgrade request with a non-standard HTTP method no longer throws IllegalArgumentException.
• http4k-template-freemarker: [Fix] FreemarkerTemplates.safeConfiguration(...) now sets newBuiltinClassResolver = TemplateClassResolver.SAFER_RESOLVER and disables ?api
• http4k-wiretap: [Fix] MermaidDiagramView no longer renders captured Mermaid source with ?no_esc
• http4k-template-freemarker: Adds FreemarkerTemplates.safeConfiguration(...) factory.
• http4k-ai-a2a-sdk: Added PushNotificationUrlPolicy so urls can be validated.

v6.51.0.0

Compare Source

• http4k-*: Upgrade versions
• http4k-server-netty: [Unlikely Break] Add websocket heartbeat monitor. H/T @​oharaandrew314
• http4k-security-digest: [Unlikely Break] DigestAuthReceiver to generate challenge response with correct URI. H/T @​oharaandrew314
• http4k-core: Adds a maxDecompressedSize: Long parameter to RequestFilters.GunZip, ResponseFilters.GunZip, ServerFilters.GZip, ServerFilters.GZipContentTypes, ClientFilters.GZip, ClientFilters.AcceptGZip, and the underlying Body.gunzippedStream.

v6.50.0.0

Compare Source

• http4k-template-pug4j: [Unlikely break] Pug4jTemplates.HotReload now canonicalizes the resolved template path against baseTemplateDir and rejects any ViewModel.template() that escapes the base.
• http4k-security-digest: [Unlikely break] DigestAuthProvider.verify now also rejects credentials whose uri parameter does not match the actual request URL.
• http4k-ai-mcp-*: [Unlikely Break] MCP session and message IDs now derive from SecureRandom by default.
• http4k-security-oauth: [Unlikely break] OAuth server now persists a nonce for any openid scope (previously only CodeIdToken) and validateNonceAfterToken fail-closes when the token-endpoint id_token is missing or its nonce mismatches.
• http4k-format-xml: [Unlikely break] defaultXmlParsingConfig now sets disallow-doctype-decl and FEATURE_SECURE_PROCESSING, so Body.xml()/asXmlDocument() reject any document with a <!DOCTYPE>.
• http4k-webhook: [Unlikely break] ServerFilters.VerifyWebhookSignature now also rejects messages whose webhook-timestamp is more than tolerance away from clock.instant() (default tolerance 5.minutes, clock Clock.systemUTC()), per the Standard Webhooks scheme. Captures of valid webhooks can no longer be replayed indefinitely. Pass a Clock.fixed(...) to control timing in tests.
• http4k-multipart: [Unlikely break] MultipartFormBody.from, multipartIterator() and Body.multipartForm(...) cap the body at 10MB and 1000 parts by default. Pass maxStreamLength/maxPartCount to override.
• http4k-serverless-lambda: [Unlikely break] Single-value headers from API Gateway/ALB events are no longer split on commas; values that legitimately contain commas (e.g. X-Forwarded-For: client, proxy1, proxy2) now reach the handler intact. True multi-values continue to flow via multiValueHeaders.
• http4k-connect-github: [Fix] Header.X_HUB_SIGNATURE_256 lens no longer crashes on an X-Hub-Signature-256 header missing the sha256= prefix; VerifyGitHubSignatureSha256 now returns 401 for malformed signatures instead of 500.
• http4k-ai-llm-azure: [Fix] AzureClient now attaches the API key as an outbound Authorization: Bearer header (was wired to the inbound ServerFilters.BearerAuth checker.
• http4k-config: [Fix] Secret.toString() and Secret.hashCode() no longer expose a stable hash of the plaintext (was Secret(hashcode = <Arrays.hashCode-of-plaintext>)); Secret.equals returns false for non-Secret inputs instead of throwing ClassCastException.
• http4k-multipart: [Fix] A multipart part whose first header line begins with whitespace (a folded-header continuation with nothing to continue) now raises a ParseError instead of crashing with NullPointerException.
• http4k-ops-opentelemetry: [Fix] OpenTelemetry tracing strips user:pass@ userInfo from request URIs before writing them to span attributes (url.full, legacy http.url) and the default span name, so basic-auth-in-URL credentials no longer reach the tracing backend.
• http4k-security-oauth: [Fix] Server-side PKCE is now enforced — code_challenge is stored at authorize and an S256 code_verifier is required at token. code_challenge_method=plain is rejected per RFC 7636 §7.2.
• http4k-security-oauth: [Fix] Post-callback redirect strips scheme/authority and collapses leading / and \ runs, neutralizing open-redirects of the form //evil.com and /\evil.com.
• http4k-security-oauth: [Fix] AuthRequest is re-validated at AuthenticationComplete; CSRF/nonce compare is null/blank-safe; several redirectUri!! NPEs replaced with typed InvalidAuthorizationRequest.
• http4k-security-oauth: Adds opt-in requirePkce: Boolean = false on OAuthServer. When true, every authorize/token exchange must use PKCE (recommended per RFC 9700).
• http4k-security-oauth: [Fix] AuthServerDiscovery rejects a scheme-less resource pointing at root.
• http4k-security-oauth: requirePkce is exposed on the underlying GenerateAccessToken / GenerateAccessTokenForGrantType / AuthorizationCodeAccessTokenGenerator, mitigating potential PKCE downgrade.
• http4k-security-digest: [Fix] DigestAuthProvider.verify now hashes with the configured algorithm instead of hardcoded MD5.
• http4k-*: Secret-bearing value types are now hidden() so their raw value no longer surfaces in toString().

v6.49.0.0

Compare Source

• http4k-*: Upgrade versions
• http4k-core: [Break] reverseProxy()/reverseProxyRouting() now default to Exact host matching instead of Contains, so a request Host header that merely contains a configured virtual host (e.g. host1.evil.com for vhost host1) no longer routes to it. Pass matcher = Contains to opt back into substring matching.
• http4k-core: [Unlikely break] ExecutorService.withRequestTracing() applies a defaultTimeout (60s by default, configurable) to the untimed invokeAll/invokeAny so a slow or dead task can no longer pin pool threads indefinitely. No code change needed; only affects callers whose tasks legitimately ran longer than default.
• http4k-core: [Unlikely break] Header.AUTHORIZATION_BASIC / Request.basicAuthentication() now return null for any malformed Basic credentials (wrong scheme, invalid base64, or no colon in the decoded value) instead of manufacturing Credentials("", ""). Lets callers reliably distinguish absent/invalid credentials from genuinely empty ones.
• http4k-server-netty: [Unlikely break] Cap aggregated request body size at 10MB (was unbounded ~2GB) to prevent OOM; oversized requests now get a 413 Request Entity Too Large. Duplicate and modify the Netty class if you need a different limit.
• http4k-core: [Unlikely break] Cap GZip decompression at 10MB (was unbounded) to prevent possible OOM; oversized requests through ServerFilters.GZip/RequestFilters.GunZip now get a 413 Request Entity Too Large, and decompressing elsewhere throws SizeLimitExceededException. Duplicate and modify the Gzip functions if you need a different limit.
• http4k-core: [Unlikely break] ServerFilters.Cors no longer emits the spec-invalid Access-Control-Allow-Origin: * together with Access-Control-Allow-Credentials: true.
• http4k-core: [Fix] bearerToken() extracts the token for any casing of the Bearer scheme (e.g. BEARER), instead of returning the raw header value.
• http4k-core: [Fix] Improve safe path parsing in ResourceLoader.Classpath
• http4k-core: [Deprecation] Add Sha256 (with hash and hmac) and deprecate HmacSha256, whose hash was misleadingly unkeyed SHA-256. Replace HmacSha256.hash/hmacSHA256 with Sha256.hash/Sha256.hmac.
• http4k-connect-openfeature: [New module] Standard OpenFeature Remote Evaluation Protocol client
• http4k-connect-openfeature-fake: [New module] Fake to setup and evaluate OpenFeature flags
• http4k-ops-openfeature: [New module] Support for plugging OpenFeature into request chain, including typesafe lenses for extracting flags from prinicpal and context during request processing.
• http4k-bridge-vertx: Stream request and response bodies instead of buffering.
• http4k-bridge-ratpack: Stream request and response bodies instead of buffering.

v6.48.0.0

Compare Source

• http4k-*: Upgrade versions
• http4k-security-digest: [Break] Remove default Nonce verifier option so avoid bad config
• http4k-core: [Break] Deprecate BasicCookieStorage (rename to InsecureCookieStorage) and replace with RFC 6265 compliant DefaultCookieStorage. This should be a drop-in replacement.
• http4k-core: [Deprecation] Rename Java8HttpClient -> URLConnectionHttpCilent
• http4k-core: [Fix] Handle brace quantifiers in UriTemplate regex patterns. H/T @​ukman48
• http4k-connect-amazon-iamidentitycenter: Update amazon sso grant type wire values. H/T @​oharaandrew314
• http4k-connect-amazon-s3: Allow content streaming for S3 via connect H/T @​asadmanji
• http4k-core: Rejects illegal characters in Status description field (could break HTTP message)
• http4k-client-okhttp: Fix request streaming

v6.47.2.0

Compare Source

• http4k-*: Upgrade versions
• http4k-connect-amazon-kms-fake: FakeKMS to generate keys with an injectable SecureRandom; allowing for deterministic testing.

v6.47.1.0

Compare Source

• http4k-*: Upgrade versions
• http4k-bridge-spring: Add support for SSE and WS bridging

v6.47.0.0

Compare Source

• http4k-*: Upgrade versions
• http4k-platform-aws: [Unlikely break] - Fix #​1533 Aws sig4 path canonicalization needs double encoding. H/T @​aharin
• http4k-ai-mcp-a2a-bridge: [New Pro module!] Expose any A2A server as an MCP server, allowing for LLM -> LLM communication.
• http4k-wiretap: Better recording of incoming HTTP requests.
• http4k-connect-amazon-iamidentitycenter: [Fix] Use generated JSON adapters for SSOCacheManager. H/T @​oharaandrew314

v6.46.1.0

Compare Source

• http4k-*: Upgrade versions
• http4k-*: Various Moshi adapters converted to be Factories instead of using annotation based lookup
• http4k-connect-amazon-sts-*: Add GetCallerIdentity support to STS client and fake. H/T @​feknall

v6.46.0.0

Compare Source

• http4k-*: Upgrade versions
• http4k-ai-a2a-sdk: [New Pro module!] A fully-featured SDK for the A2A protocol. Supports JSON RPC and Rest version of the protocol.
• http4k-ai-a2a-client: [New Pro module!] Typesafe HTTP and testing clients for A2A.
• http4k-wiretap: [Breaking] Better support for HTTP/Poly/A2A/MCP. The old Intercept {} form is now Intercept.http {}

v6.45.1.0

Compare Source

• http4k-security-oauth: Added missing OAuth client filter override.

v6.45.0.0

Compare Source

• http4k-*: Upgrade versions
• http4k-security-oauth: [Break] RefreshingOAuthToken, AutoDiscoveryOAuthToken refactored with pluggable OAuth flow and refresh filters. The oAuthFlowFilter parameter no longer has a default — use the OAuthProviderConfig or Credentials overloads for the previous behaviour. Parameter oauthCredentials renamed to clientCredentials.
• http4k-api-openapi: Include webhook schemas in contract spec. H/T @​cies
• http4k-security-oauth: Add ClientFilters.OAuthJwtAssertion for RFC 7523 JWT assertion grants (SEP-990 ID-JAG enterprise auth).
• http4k-ai-mcp-sdk: Add support for all recent DRAFT-2026-v1 features (as of 04/26).
• http4k-ai-mcp-client: DiscoveredMcpOAuth now supports pluggable OAuth flow and refresh filters for custom grant types (e.g. JWT assertion for enterprise IdP).
• http4k-core: Add Header.ALLOW lens for RFC 9110 Allow header.
• http4k-realtime-core: Add Header.X_ACCEL_BUFFERING lens with XAccelBuffering enum.

v6.44.0.0

Compare Source

• http4k-*: Upgrade versions, including Kotlin to 2.3.21
• http4k-ai-mcp-sdk: [Break] Unified JSON-RPC message handling. McpHandler now takes McpRequest/McpResponse (sealed: Ok/Accepted/Unknown). Custom McpHandler and McpFilter implementations will need adjusting.
• http4k-ai-mcp-sdk: [Break] All MCP Message objects have _meta fields now. Conversion from object to class.
• http4k-ai-mcp-sdk: [Break] McpOpenTelemetrySpanModifiers renamed to McpOpenTelemetrySpanModifier (singular). Methods now take McpRequest/McpResponse instead of McpJsonRpcRequest/McpJsonRpcResponse, giving access to session and HTTP request context. Dispatch by method field removed — modifiers use typed is checks instead.
• http4k-ai-mcp-sdk: [Break] Client.updateTask() no longer takes a timeout parameter. Added Client.requestRoots().
• http4k-ai-mcp-sdk: [Break] ToolResponse.ElicitationRequired.elicitations type changed from List<McpElicitations.Request.Url> to List<McpElicitations.Request.Params.Url>.
• http4k-ai-mcp-testing: [Break] Test MCP Clients now need to be started in all tests. This allows for handshaking and forces compliance with the MCP spec. You can use TestMcpClient.useClient() to get a pre-started instance.
• http4k-ai-mcp-sdk: [Fix] Number values in tool schemas serialized correctly.
• http4k-ai-mcp-sdk: [Fix] X402 and MPP payment filters fail with correct error message.
• http4k-testing-chaos: Add ReturnResponse behaviour. H/T @​jamieredding.
• http4k-connect-amazon-dynamodb-fake [Fix] Condition expression to be properly evaluated when item is missing. H/T @​oharaandrew314
• http4k-connect-openai-* Add logprobs, structured output, and reasoning to OpenAI chat completions. H/T @​torfinnberset

v6.43.0.0

Compare Source

• http4k-*: Upgrade versions
• http4k-connect-amazon-kms: [CVE upgrade] Bouncy Castle upgrade to 1.84 Advisory
• http4k-template-thymeleaf: [CVE upgrade] Thymeleaf upgrade to 3.1.4.RELEASE Advisory
• http4k-ai-mcp-sdk: [Fix] All Tool Calls in OTel are mistakenly tagged as errors.
• http4k-ai-mcp-sdk: [Unlikely Break] ServerTools and co are now constructed via tools(). Simply replace the calls - the as the rest of the behaviour is unchanges.
• http4k-ai-mcp-sdk: [Unlikely Break] Externalised Progress Token so that you need
• http4k-ai-mcp-sdk: [Unlikely Break] Drop support for JsonRpc batching as it is not supported by the MCP spec.
  to pass it directly into progress calls. This makes it explicit that callers without progress tokens will not be able to track progress.
• http4k-core: [Unlikely Break] FollowRedirects no longer follows HTTPS to HTTP redirects, preventing possible credential leakage over unencrypted connections.
• http4k-security-oauth: Validate OAuth discovery metadata per RFC 8414 §3.3 (issuer same-origin check) and RFC 9728 §3.3 (resource field same-origin and path validation).

v6.42.0.0

Compare Source

• http4k-*: Upgrade versions
• http4k-ai-mcp-sdk: [Unlikely Break] Better support for custom MCP app resource loading. Rename of RenderMcpApp parameters might break anything using named params.
• http4k-ai-mcp-sdk: [Fix] Include tool and prompt names in OTel traces.
• http4k-ai-mcp-sdk: Add better OTel support for MCP tracing span modifiers. We have extrapolated from the OTel semantic conventions here and are following the spec so some of these are not official values.
• http4k-tools-verify: Verification scanning of test dependencies as well as production dependencies.

v6.41.0.0

Compare Source

• http4k-*: Upgrade versions
• http4k-ai-mcp-sdk: [Unlikely Break] Add support for custom MCP session handshaking by introducing InitializeHandler.
• http4k-ai-mcp-testing: Support for testing MCP handshaking with custom ClientCapabilities.
• http4k-tools-verify: Support for key rotation when signing cosigned artifacts.

v6.40.1.0

Compare Source

• http4k-*: Upgrade versions
• http4k-tools-verify: Exports all verification artifacts (bundles, SBOMs, provenance, license reports, cosign.pub) to build/http4k-verify/ for independent inspection and audit.
• http4k-tools-verify: Generates a JSON verification report at build/http4k-verify/verification-report.json with per-module signature status and exported file paths.
• http4k-tools-verify: Added clearHttp4kVerificationCache Gradle task to force re-verification of all artifacts.

v6.40.0.0

Compare Source

• http4k-*: Upgrade versions
• http4k-tools-verify: [New Pro module!] Gradle plugin for automated supply chain verification. Verifies cosign signatures on all http4k artifacts resolved from the http4k Enterprise Repository at build time. Pure JVM — no CLI tools required. Apply with id("org.http4k.verify").

v6.39.1.0

Compare Source

• http4k-*: Upgrade versions
• http4k-server-netty: [Fix] Properly chunk and consume chunked websocket messages. H/T @​oharaandrew314

v6.39.0.0

Compare Source

• http4k-*: Upgrade versions
• http4k-security-oauth: Better support for OAuth discovery in FakeOAuthServer.
• http4k-ai-mcp-*: [Breaking] ResourceResponse, PromptResponse, and CompletionResponse are now sealed interfaces with Ok and Error subtypes. Construct via ResourceResponse.Ok(...) etc. SamplingResponse and ElicitationResponse gain a new Error subtype. Error variants take a message: String and round-trip through the protocol using a custom domain error code (-32050), allowing http4k clients to reconstruct *.Error on the client side rather than surfacing them as McpError.Protocol.

v6.38.0.0

Compare Source

• http4k-*: Upgrade versions
• http4k-*: New http4k Agent Skills Marketplace — a Claude Code plugin providing AI coding guidance for all 200+ http4k modules. Install the marketplace and then the plugin via /plugin in Claude Code.
• http4k-connect-ai-ollama-: Support JSON schema structured output in Ollama. H/T @​torfinnberset

v6.37.0.0

Compare Source

• http4k-*: Upgrade versions, including Kotlin to 2.3.20
• http4k-ops-opentelemetry: [Possible Break] Convert to use new OpenTelemetrySemanticConventions for attribute naming. This may break some observability. It is possible to revert to the old versions by passing LegacyHttp4kConventions to the OTel filters instead. It is worth studying the new conventions to see if they are suitable for your use case.
• http4k-ops-opentelemetry: [Fix] Urls not being correctly shown in defaultSpanNamer. This affected client filter span naming.
  http4k-ops-opentelemetry: Add OpenTelemetryClock shim to allow the control of time inside OpenTelemetry APIs.

v6.36.0.0

Compare Source

• http4k-*: Upgrade versions
• http4k-connect-mpp: [New Pro module!] Support for MPP payments protocol. Protect your endpoints with MPP payments and sign and verify MPP payments using standardised server and client filters.
• http4k-ai-mcp-mpp: [New Pro module!] Support for MPP payments in MCP servers, allowing payments to be charged for tool and general MCP usage by plugging in an MPP verifier.
• http4k-server-netty: [Fix] Don't drop websocket messages if received before the websocket is fully registered. H/T @​oharaandrew314
• http4k-connect-amazon-sqs: [Fix] Correct property typo in SendMessageBatch operation. H/T @​oharaandrew314
• http4k-connect-x402: [Fix] This module was published under the wrong Maven central coordinates.
• http4k-connect-x402-fake:[Fix] This module was published under the wrong Maven central coordinates.

v6.35.0.0

Compare Source

• http4k-*: Upgrade versions
• http4k-ai-mcp-x402: [New Pro module!] Support for X402 payments in MCP servers, allowing payments to be charged for tool and general MCP usage by plugging the server into a standardised X402 facilitators. Includes server and client filters.
• http4k-connect-*: [Unlikely break] Corrected http4k Connect Action variance. This affects all Connect client modules.
• http4k-ai-mcp-sdk: [Unlikely break] Improved support for varying the shape of the MCP meta response fields, and plugging into the http4k lense system.

v6.34.0.0

Compare Source

• http4k-*: Upgrade versions
• http4k-connect-x402: [New Pro module!] Support for X402 payments protocol client. You'll need to plug in your own signer (use an OSS one such as web3j).
• http4k-connect-x402-fake: [New Pro module!] Fake implementation of X402 Facilitator for testing.
• http4k-ops-opentelemetry: Added events implementation AutoOpenTelemetryEvents for plugging the http4k event system into OpenTelemetry backends. Supports both span-based and log events.
• http4k-testing-webdriver: Include basic auth in requests from the WebDriver. H/T @​tamj0rd2
• http4k-ai-mcp-sdk: Fix to allow for custom JSON types in MCP server tool responses.

v6.33.0.0

Compare Source

• http4k-*: Upgrade versions
• http4k-ai-mcp-*: [Deprecation] use mcp() as a replacement for mcpHttpStreaming() as this is now the standard implementation. Simple replacement

v6.32.0.0

Compare Source

• http4k-*: Upgrade versions
• http4k-ai-mcp-sdk: [Breaking] Defaulting of MCP Entity and Version names in MCP Clients. We have reordered the parameters to the constructor to
  accommodate.
• http4k-web-datastar: [Possible Break] Render Datastar Elements with new lines as events with multiple data element lines.
• http4k-ai-mcp-sdk: [Fix] Improve lens support for Tool arguments which are not strings.
• http4k-ai-mcp-sdk: [Fix] Improve lens support for Tool arguments which are not strings.
• http4k-ai-mcp-sdk: Improve support for OpenTelemetry tracing as per the OTel specification.
• http4k-template-handlebars: Support for template suffixes.
• http4k-ops-opentelemetry: Fix up SSE tracing propagation.
• http4k-realtime-core: SSE security filters now support modification of the incoming request - this allows attachment of request context to be passed
  through the filter chain.
• http4k-testing-playwright: Add support for Polyhandlers as well as HttpHandlers.

v6.31.1.0

Compare Source

• http4k-*: Upgrade versions
• http4k-ai-mcp-sdk: [Fix] Add missing ToolUseId type to MCP JSON

v6.31.0.0

Compare Source

• http4k-*: Upgrade versions
• http4k-core: [Unlikely break] Header lenses now strip quotes from header values (RFC 2045). H/T @​andy-barlow
• http4k-multipart: [Unlikely break] Default to using application/octet-stream for unknown content types. H/T @​andy-barlow
• http4k-ai-mcp-sdk: Add convenience function asServer() to convert any singular ServerCapability into a server

v6.30.1.0

Compare Source

• http4k-*: Upgrade versions
• http4k-testing-webdriver: [Fix] Respect the formaction and formmethod of the used submit input H/T @​tamj0rd2
• http4k-ai-mcp-testing: Fixed test MCP Apps host to accept non-string arguments from hosted app.
• http4k-ai-mcp-testing: Honour CSP headers when running MCP Apps host.

v6.30.0.0

Compare Source

• http4k-*: Upgrade versions
• http4k-ai-mcp-sdk: [Breaking] Adding support for serverside OpenTelemetry Conventions MCP spans. API changes to allow for this change.

v6.29.0.0

Compare Source

• http4k-*: Upgrade versions
• http4k-ai-mcp-client: [Breaking] Alteration to ToolResponse.Error to have content instead of just a string
• http4k-ai-mcp-sdk: [Breaking] Alteration to ToolResponse.Error to have content instead of just a string
• http4k-ops-opentelemetry: Added SSE filters to capture OTel traces
• http4k-ops-opentelemetry: Add support for OpenTelemetry Semantic Conventions (1.38.0)

v6.28.1.0

Compare Source

• http4k-*: Upgrade versions
• http4k-ai-mcp-testing: Remove unnecessary dependencies, various fixes to the MCP App test host

v6.28.0.0

Compare Source

• http4k-*: Upgrade versions, including Kotlin to 2.3.10
• http4k-ai-mcp-sdk: [Pro: Breaking] - Update MCP SDK to support latest MCP specification (2025-11-25), including support for Tasks, expanded Tool support,
  URL Form Elicitations and Sampling upgrades. Plus conformance updates to the latest MCP conformance tests. Also support for MCP Apps spec, allowing UIs to be
  usable inside Claude Code and friends. Small tweaks to the API surface which should be simple to fix.
• http4k-ai-mcp-client: [Pro: Breaking] - Updated client to support MCP 2025-11-25 features.
• http4k-ai-mcp-testing: [Pro: New module!] - Clients for testing MCP servers and a basic MCP Apps host to test out MCP Apps (UIs which can live in Claude
  and co)

v6.27.0.0

Compare Source

• http4k-*: Upgrade versions
• http4k-connect-amazon-dynamo-fake:[Fix #​1477] Fake DynamoDB KeyConditionExpression sometimes fails with floating-point values
• http4k-*: [Breaking] Upgrades to Exposed v1.0.0 will mean API changes are required for modules relying on that library. See the Exposed docs for details
• http4k-testing-webdriver: [Fix] Was throwing wrong NoSuchElementException.

v6.26.1.0

Compare Source

• http4k-*: Upgrade versions
• http4k-connect-amazon-secretsmanager: Add the SecretsManagerRotationEvent. H/T @​oharaandrew314
• http4k-server-undertow: [Fix] CVE-2024-3884 CVE-2024-4027 CVE-2025-12543
• http4k-template-*: Templates report underlying cause when ViewNotFound. H/T @​npryce

v6.26.0.0

Compare Source

• http4k-*: Upgrade versions
• http4k-web-datastar*: [Unlikely break] #​1467: Only include useViewTransition and mode fields in events if values are overridden. H/T @​Christian-Broomfield
• http4k-format-argo*: [Breaking] Changes to object hashcodes generated by Argo

v6.25.1.0

Compare Source

• http4k-*: Upgrade versions
• http4k-connect-amazon-cognito*: Implement additional AWS Cognito actions H/T @​torfinnberset
• http4k-connect-slack: Support better BlockKit options H/T @​torfinnberset
• http4k-core: [Fix] ClientFilters.FollowRedirects handles relative URLs in the Location header. H/T @​npryce

v6.25.0.0

Compare Source

• http4k-*: Upgrade versions, including Kotlin to 2.3.0

v6.24.1.0

Compare Source

• http4k-connect-amazon-scheduler: [New module!] AWS EventBridge Scheduler client. H/T @​aharin
• http4k-connect-amazon-scheduler-fake: [New module!] AWS EventBridge Scheduler fake. H/T @​aharin

v6.24.0.0

Compare Source

• http4k-*: Upgrade versions
• http4k-platform-azure: [Fix #​1453] AzureHttpClient blocks forever.
• http4k-platform-docker*: [New module!] Utility module for working with Docker configurations H/T @​time4tea
• http4k-format-toon*: [New module!] Support for compact Toon format. Includes auto-marshalling capabilities.

v6.23.1.0

Compare Source

• http4k-*: Upgrade versions
• http4k-ai-mcp-sdk*: [Fix] Wire in outputSchema for MCP tools

v6.23.0.0

Compare Source

• http4k-*: Upgrade versions, including Kotlin to 2.2.21
• http4k-multipart: [Fix #​1446] Added length field to MultipartFormFile.
• http4k-format-kondor: Simpler API for registering converters. H/T @​npryce

v6.22.0.0

Compare Source

• http4k-*: Upgrade versions
• http4k-core*: [Unlikely break] Introduce QUERY HTTP method as RFC has been approved. H/T @​npryce
• http4k-core*: [Fix #​1438] URL encode Flash cookie content. H/T @​cies
• http4k-core*: [Fix #​1426] Avoiding repeated copies of HttpMessage.bodyString(). H/T @​hermannm

v6.21.1.0

Compare Source

• http4k-*: Upgrade versions
• http4k-ai-mcp-conformance: [New module!] Published MCP SDK Conformance test server as a separate example module. This allows for wider deployment against
  the MCP conformance tests.

v6.21.0.0

Compare Source

• http4k-*: Upgrade versions
• http4k-ai-mcp-sdk: [Breaking] Various tweaks to align with MCP conformance tests. Some trivial breaks, which should make servers better aligned with the
  spec.

v6.20.2.1

Compare Source

• http4k-realtime-core: [Fix] Better support for all SSE delimiters.
• http4k-ai-mcp-client: [Fix] Better support for all SSE delimiters.

v6.20.2.0

Compare Source

• http4k-*: Upgrade versions
• http4k-realtime-core: SSE client now supports more line ending types (previously only /n/n)
• http4k-ai-mcp-client: MCP client now supports more line ending types (previously only /n/n)

v6.20.1.0

Compare Source

• http4k-*: Upgrade versions
• http4k-ops-opentelemetry: Set open telemetry http.user_agent and http.client_ip attributes as they are used by AWS Xray. H/T @​aharin
• http4k-ops-opentelemetry: AWS Xray requires message.type and messaging.message_payload_size_bytes. H/T @​aharin
• http4k-ops-opentelemetry: Set span request attribute before span is created so that they can be used by RuleBasedRoutingSampler. H/T @​aharin
• http4k-platform-aws: Add support for configurable payload mode in AwsRequestPreSigner. H/T @​torfinnberset

v6.20.0.3

Compare Source

• http4k-ai-mcp-*: [Fix] Fix up missing extension (accidentally removed).

v6.20.0.2

Compare Source

• http4k-ai-mcp-*: [Fix] Add session id to output in HttpNonStreaming mode

v6.20.0.1

Compare Source

• http4k-ai-mcp-*: [Fix] Some MCP clients require a 200 instead of a 202 in MCP responses (that are stateless)

v6.20.0.0

Compare Source

• http4k-*: Upgrade versions
• http4k-ai-mcp-*: [Breaking] Non-streaming mode spec: Alignment with the MCP spec to be compatible with clients such as Claude Desktop (change to the spec
  to not support JSON RPC). This simplifies integration points.

v6.19.0.0

Compare Source

• http4k-*: Upgrade versions, including JUnit to v6.0.0
• http4k-ai-llm-gemini: Fix #​1421. Make strict flag nullable for Gemini chat completions.

v6.18.1.0

Compare Source

• http4k-*: Upgrade versions
• http4k-server-helidon: [Unlikely break] Helidon upgrade has slightly changed behaviour around new lines in data events. Before, new lines would be put
  into multiple data events, now they are preserved in a single event.
• http4k-template-htmlflow: [New module] Typesafe templates using HTMLFlow. H/T @​BernardoPe
• http4k-*: Handle additional connection issues in HTTP Clients. H/T @​alex859

v6.18.0.1

Compare Source

• http4k-*: Fix maven dependencies in published POMs

v6.17.0.0

Compare Source

• http4k-*: Upgrade versions
• http4k-mcp-*: [Breaking] These modules are now living under their new coordinates in http4k-ai-mcp-*. Please change your imports and dependencies to
  reflect this.
• http4k-web-datastar*: [Breaking] This is the post Datastar v1 release. The API has significantly changed to match the changes to D* mechanisms - most
  notably: Fragments are now called Elements, and the number of SSE events has been reduced from 5 to 2 (datastar-patch-elements and
  datastar-patch-signals). See the D* docs for more details. You can of course continue to use the old API by using an old version of this module.
• http4k-connect-amazon-cognito [Breaking] Align RespondToAuthChallenge to the official doc. The ChallengeResponses in the response is now a
  Map<String, String> instead of the incorrect Map<ChallengeName, String>. H/T @​alphaho
• http4k-testing-powerassert [New Module!] Power Assert is now bundled with Kotlin, so it's th

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.