Skip to content

Bump the deps group with 9 updates - #88

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/gradle/deps-3d016c1a6d
Closed

Bump the deps group with 9 updates#88
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/gradle/deps-3d016c1a6d

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the deps group with 9 updates:

Package From To
net.bytebuddy:byte-buddy-agent 1.18.15 1.18.16
com.google.code.gson:gson 2.14.0 2.15.0
ch.qos.logback:logback-classic 1.6.5 1.6.6
se.bjurr.violations:violations-lib 3.0.2 3.0.3
io.ktor:ktor-server-core 3.6.0 3.6.1
io.ktor:ktor-server-netty 3.6.0 3.6.1
io.ktor:ktor-server-status-pages 3.6.0 3.6.1
io.ktor:ktor-server-html-builder 3.6.0 3.6.1
org.graalvm.buildtools.native 1.1.16 1.1.18

Updates net.bytebuddy:byte-buddy-agent from 1.18.15 to 1.18.16

Release notes

Sourced from net.bytebuddy:byte-buddy-agent's releases.

Byte Buddy 1.18.16

  • Correct detection of a dropped implicit this frame in constructors with long or double parameters when using Advice.
  • Detect a dropped uninitialized this frame in constructors after full frames when using Advice with copied arguments.
  • Update ASM to version 9.11.1 and the ASM to Class File API bridge to version 0.0.14.
  • Use a valid tag for the Gradle plugin portal.
Changelog

Sourced from net.bytebuddy:byte-buddy-agent's changelog.

23. October 2026: version 1.18.16

  • Correct detection of a dropped implicit this frame in constructors with long or double parameters when using Advice.
  • Detect a dropped uninitialized this frame in constructors after full frames when using Advice with copied arguments.
  • Update ASM to version 9.11.1 and the ASM to Class File API bridge to version 0.0.14.
  • Use a valid tag for the Gradle plugin portal.
Commits
  • 0229449 [publish] Releasing Byte Buddy 1.18.16
  • 29c1a29 [release] Complete failed release from where it failed.
  • 2f7c4ed Change tag which was rejected.
  • 6ade578 [release] Release new version
  • 7d6ad78 Update checksums
  • d7bf69f Detect dropped uninitialized 'this' frame in constructors after full frames.
  • 2901502 Compare constructor frame divergence in frame entries rather than slots.
  • 8ade117 Update ASM and bridge.
  • 4e25942 [publish] Start next development iteration 1.18.16-SNAPSHOT
  • See full diff in compare view

Updates com.google.code.gson:gson from 2.14.0 to 2.15.0

Release notes

Sourced from com.google.code.gson:gson's releases.

Gson 2.15.0

What's Changed

These are some of the more important changes

API addition:

Behaviour changes and bugfixes:

New Contributors

Full Changelog: google/gson@gson-parent-2.14.0...gson-parent-2.15.0

Commits
  • fcd4169 [maven-release-plugin] prepare release gson-parent-2.15.0
  • 828cbe0 Update protobuf-maven-plugin dependency. (#3153)
  • 66dd98a Disable Spotless plugin before Java 21. (#3152)
  • 094f500 Fix typo in comment (#3148)
  • 881d2b5 Consistently use "Gson" instead of "GSON" as project name (#3150)
  • e2292f9 Address a few static analysis findings. (#3141)
  • 67427c4 Bump the github-actions group across 1 directory with 5 updates (#3133)
  • 845664b Correct logic for BOM detection. (#3137)
  • 216c41b Bump com.fasterxml.jackson.core:jackson-databind (#3136)
  • 854c825 Simplify key removal in LegacyProtoTypeAdapterFactoryTest (#3124)
  • Additional commits viewable in compare view

Updates ch.qos.logback:logback-classic from 1.6.5 to 1.6.6

Release notes

Sourced from ch.qos.logback:logback-classic's releases.

Logback 1.6.6

2026-10-25 Release of logback version 1.6.6

• LoggingEventVO now rejects, during deserialization, throwable proxies whose cause or suppressed entries point back into the graph of proxies, for example to their own parent. Such graphs cannot be produced by logback itself. However, a crafted stream sent to a socket receiver could use serialization back-references to build them, after which DefaultThrowableRenderer and SyslogAppender would loop forever and the recursive converters would overflow the stack. These streams are now rejected with an InvalidObjectException. Circular exceptions logged by the application are still transmitted correctly. This issue was reported and fixed in [PR #1079](qos-ch/logback#1079) by arfa-21.

• FileNamePattern now escapes characters with a special meaning in regular expressions, such as (, [ or +, when converting the literal parts of a file name pattern into a regex. Previously, RollingFileAppender failed to start when the path contained an unbalanced parenthesis, as in C:/Users/Michael(Financ. This issue was reported in issues/914 by danamlund. Moreover, with SizeAndTimeBasedRollingPolicy and a pattern such as app.%d.(%i).log, existing archives were not recognized. After a restart within the same period, the next rollover could overwrite an existing archive, and maxHistory and totalSizeCap never removed such archives. This issue was reported in issues/933 by GeoffreyBoulay. The fix was contributed in [PR #1077](qos-ch/logback#1077) by Jialin Chen. Regex metacharacters in %d{...} date patterns are now escaped as well.

• The conversion of date patterns into regular expressions now follows the rules of DateTimeFormatter, which logback uses to format dates, instead of those of SimpleDateFormat. In particular, the L (stand-alone month) pattern letter is now supported.

• SyslogOutputStream now connects its DatagramSocket to the syslog host. Previously, the socket was bound to the wildcard address, so that hardened environments saw an unconnected UDP listener on all interfaces for as long as the application ran. This issue was reported in issues/939 by joao-rebelo. The fix was contributed in [PR #1076](qos-ch/logback#1076) by Lyin-OTTF.

If the socket cannot be connected, for example because the network is not yet available, SyslogOutputStream falls back to an unconnected socket and SyslogAppenderBase emits a warning. When a datagram sent on a connected socket fails due to an ICMP "port unreachable" message caused by an earlier datagram, the datagram is sent once more so that no message is lost. If the retry also fails, a single warning is emitted instead of one error per event.

• OutputStreamAppender now stops its encoder when the appender is stopped. Previously, encoders holding resources until they were stopped, such as those of logstash-logback-encoder, were never released, causing heap growth at each reconfiguration. This issue was fixed in [PR #1072](qos-ch/logback#1072) by Samuel Fernandes.

• During variable substitution, an unmatched right curly brace now causes an error to be reported, with the original value left unchanged. Previously, the brace and all subsequent characters were silently dropped, so that %m}some text became %m. This issue was reported in issues/836 by philsttr.

• LogbackMDCAdapter now stores MDC entries in a LinkedHashMap, so that the %X converter outputs them in insertion order. This issue was reported in LOGBACK-1337 and fixed by Craig P. Motlin.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit a9ee8019ee183e076ff5477957dbf90c4b04dd92 associated with the tag v_1.6.6. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Commits
  • a9ee801 prepare release 1.6.6
  • 7fa8e8e throw ScanException on unmatched '}' during variable substitution, fixes #836
  • 355b931 Test round trip of circular exceptions through LoggingEventVO
  • c7b8e2f reject cyclic throwable proxies in LoggingEventVO.readObject
  • 6217f11 fix loging of ThrowableProxy constructor taking isCyclic boolean
  • 0b95858 LOGBACK-1337 LogbackMDCAdapter should store mdc in LinkedHashMap to predict o...
  • 5c1f577 add LinkedHashMap to HardenedObjectInputStream whitelist
  • 7c36c71 Escape regex metacharacters in date patterns, harden rolling tests
  • d268774 Align date pattern to regex conversion with DateTimeFormatter
  • b4b4828 Escape regex metacharacters of literal text in FileNamePattern regexes
  • Additional commits viewable in compare view

Updates se.bjurr.violations:violations-lib from 3.0.2 to 3.0.3

Release notes

Sourced from se.bjurr.violations:violations-lib's releases.

v3.0.3

🐛 Bug Fixes

  • parse SARIF locations without physicalLocation or artifactLocation (2f566 RobinT) #232

📦 Dependency updates

  • update dependency tools.jackson.core:jackson-databind to v3.2.4 (#230) (bca91 renovate[bot])
  • update dependency org.owasp.encoder:encoder to v1.6.0 (#229) (3400c renovate[bot])
  • update dependency org.owasp.encoder:encoder to v1.5.1 (#228) (df261 renovate[bot])
  • update dependency gradle to v9.8.2 (#227) (a0e90 renovate[bot])
  • update dependency gradle to v9.8.1 (#226) (38582 renovate[bot])
  • update dependency com.networknt:json-schema-validator to v3.0.8 (#224) (533c9 renovate[bot])
  • update plugin se.bjurr.gradle.include-virtual to v1.1.2 (#223) (3a7bc renovate[bot])
  • update dependency org.owasp.encoder:encoder to v1.5.0 (#222) (c4f4d renovate[bot])
Changelog

Sourced from se.bjurr.violations:violations-lib's changelog.

3.0.3 (2026-10-28)

Bug Fixes

  • parse SARIF locations without physicalLocation or artifactLocation (2f566 RobinT) #232

Dependency updates

  • update dependency tools.jackson.core:jackson-databind to v3.2.4 (#230) (bca91 renovate[bot])
  • update dependency org.owasp.encoder:encoder to v1.6.0 (#229) (3400c renovate[bot])
  • update dependency org.owasp.encoder:encoder to v1.5.1 (#228) (df261 renovate[bot])
  • update dependency gradle to v9.8.2 (#227) (a0e90 renovate[bot])
  • update dependency gradle to v9.8.1 (#226) (38582 renovate[bot])
  • update dependency com.networknt:json-schema-validator to v3.0.8 (#224) (533c9 renovate[bot])
  • update plugin se.bjurr.gradle.include-virtual to v1.1.2 (#223) (3a7bc renovate[bot])
  • update dependency org.owasp.encoder:encoder to v1.5.0 (#222) (c4f4d renovate[bot])
Commits
  • 2f5662c fix: parse SARIF locations without physicalLocation or artifactLocation (refs...
  • bca91c8 chore(deps): update dependency tools.jackson.core:jackson-databind to v3.2.4 ...
  • 3400c43 chore(deps): update dependency org.owasp.encoder:encoder to v1.6.0 (#229)
  • df2619a chore(deps): update dependency org.owasp.encoder:encoder to v1.5.1 (#228)
  • a0e90ba chore(deps): update dependency gradle to v9.8.2 (#227)
  • 38582d4 chore(deps): update dependency gradle to v9.8.1 (#226)
  • 533c967 chore(deps): update dependency com.networknt:json-schema-validator to v3.0.8 ...
  • 3a7bc88 chore(deps): update plugin se.bjurr.gradle.include-virtual to v1.1.2 (#223)
  • c4f4d34 chore(deps): update dependency org.owasp.encoder:encoder to v1.5.0 (#222)
  • 7ed370c chore(changelog): updating changelog
  • See full diff in compare view

Updates io.ktor:ktor-server-core from 3.6.0 to 3.6.1

Release notes

Sourced from io.ktor:ktor-server-core's releases.

3.6.1

Published 29 October 2026

Improvements

  • KTOR-10005 Native accepted TCP sockets do not enable TCP_NODELAY, unlike JVM
  • KTOR-9966 Netty poor performance on delay calls
  • KTOR-4206 The "com.typesafe.config.ConfigException$Missing" exception leaks from the typesafe config library when configuration is merged

Bugfixes

  • KTOR-10037 CIO: keep-alive connection hangs when a response fails before writing any bytes
  • KTOR-9969 Kotlin/Native CIO server occasionally closes an accepted connection with zero response bytes under CPU load
  • KTOR-9974 CIO: close_notify is written concurrently with the last record, corrupting the TLS output and the kotlinx-io segment pool
  • KTOR-9925 Resources: Constant sibling route loses to parameterized one when routes are split across separate authenticate blocks
  • KTOR-9938 Apache5: streaming response hangs when the block returns before the body arrives
  • KTOR-10023 Ktor 3.6.0 no longer throws BadRequestException for malformed paths
  • KTOR-9986 HttpRedirect: a relative Location with dot segments is not normalized, so most engines send .. in the request path
  • KTOR-10085 ETags: Ignore If-Modified-Since when If-None-Match is present
  • KTOR-9430 DI: resources are not cleaned up during testing with testApplication
  • KTOR-7175 Ktor-client, connections leak
  • KTOR-9848 Android: The Android engine crashes with Unbalanced enter/exit on response read cancellation
  • KTOR-9994 Android engine closes RawSourceChannel on the main thread and crashes with NetworkOnMainThreadException
  • KTOR-9959 Sockets: CIO writer busy-loops when a nonblocking write returns zero
  • KTOR-9970 Java: Cancelling a request before response headers does not abort the HTTP exchange
  • KTOR-10006 OpenAPI: Compiler crash on local variable using object expression
  • KTOR-9972 Android: DiskReadViolation when KtorSimpleLogger is initialized during plugin execution
  • KTOR-9985 OpenAPI compiler plugin duplicates unrelated schemas (FooDTO -> FooDTO2) after adding new routes
  • KTOR-2348 DoubleReceive: recursive receive pipeline re-entry when receiving content in a receivePipeline interceptor
  • KTOR-9968 Test engine streaming responses hang when over 1MB
  • KTOR-9894 Netty + Compression: response leaked when the client disconnects before the body is written
  • KTOR-9987 WebSockets: Netty sometimes closes socket before sending close frame
  • KTOR-9943 HttpStatement.execute can hang when its block abandons a response body
  • KTOR-9980 CallLogging: MDC entries leak stale thread-local values when provider returns null
  • KTOR-9790 testApplication: sseSession() never returns when the SSE route installs a heartbeat
  • KTOR-9884 Directories are returned as empty binaries when using nested jars
  • KTOR-4245 Code snippet in Kdoc for DefaultRequest doesn't compile
  • KTOR-10035 WebSocket drops the queued Close frame when the server session fails
  • KTOR-10036 testApplication: WebSocket client stops reading before the servers Close reply arrives
Changelog

Sourced from io.ktor:ktor-server-core's changelog.

3.6.1

Published 29 October 2026

Improvements

  • KTOR-10005 Native accepted TCP sockets do not enable TCP_NODELAY, unlike JVM
  • KTOR-9966 Netty poor performance on delay calls
  • KTOR-4206 The "com.typesafe.config.ConfigException$Missing" exception leaks from the typesafe config library when configuration is merged

Bugfixes

  • KTOR-10037 CIO: keep-alive connection hangs when a response fails before writing any bytes
  • KTOR-9969 Kotlin/Native CIO server occasionally closes an accepted connection with zero response bytes under CPU load
  • KTOR-9974 CIO: close_notify is written concurrently with the last record, corrupting the TLS output and the kotlinx-io segment pool
  • KTOR-9925 Resources: Constant sibling route loses to parameterized one when routes are split across separate authenticate blocks
  • KTOR-9938 Apache5: streaming response hangs when the block returns before the body arrives
  • KTOR-10023 Ktor 3.6.0 no longer throws BadRequestException for malformed paths
  • KTOR-9986 HttpRedirect: a relative Location with dot segments is not normalized, so most engines send .. in the request path
  • KTOR-10085 ETags: Ignore If-Modified-Since when If-None-Match is present
  • KTOR-9430 DI: resources are not cleaned up during testing with testApplication
  • KTOR-7175 Ktor-client, connections leak
  • KTOR-9848 Android: The Android engine crashes with Unbalanced enter/exit on response read cancellation
  • KTOR-9994 Android engine closes RawSourceChannel on the main thread and crashes with NetworkOnMainThreadException
  • KTOR-9959 Sockets: CIO writer busy-loops when a nonblocking write returns zero
  • KTOR-9970 Java: Cancelling a request before response headers does not abort the HTTP exchange
  • KTOR-10006 OpenAPI: Compiler crash on local variable using object expression
  • KTOR-9972 Android: DiskReadViolation when KtorSimpleLogger is initialized during plugin execution
  • KTOR-9985 OpenAPI compiler plugin duplicates unrelated schemas (FooDTO -> FooDTO2) after adding new routes
  • KTOR-2348 DoubleReceive: recursive receive pipeline re-entry when receiving content in a receivePipeline interceptor
  • KTOR-9968 Test engine streaming responses hang when over 1MB
  • KTOR-9894 Netty + Compression: response leaked when the client disconnects before the body is written
  • KTOR-9987 WebSockets: Netty sometimes closes socket before sending close frame
  • KTOR-9943 HttpStatement.execute can hang when its block abandons a response body
  • KTOR-9980 CallLogging: MDC entries leak stale thread-local values when provider returns null
  • KTOR-9790 testApplication: sseSession() never returns when the SSE route installs a heartbeat
  • KTOR-9884 Directories are returned as empty binaries when using nested jars
  • KTOR-4245 Code snippet in Kdoc for DefaultRequest doesn't compile
  • KTOR-10035 WebSocket drops the queued Close frame when the server session fails
  • KTOR-10036 testApplication: WebSocket client stops reading before the servers Close reply arrives
Commits
  • 26cc003 Release 3.6.1 (#5970)
  • b4fc04d KTOR-10035 Deliver the queued Close frame when the session fails (#5959)
  • fbd2a80 KTOR-10036 Keep the test host WebSocket client reading until the server close...
  • 516fe19 KTOR-10037 Close the CIO connection when a response fails before writing any ...
  • 3954d0c KTOR-9938: Abort Apache5 exchanges when the response body is cancelled
  • dbc9692 KTOR-9969 Shut down native socket output inside the writer coroutine
  • 3ceecd7 KTOR-9992 Fix CIO accept busy loop (#5961)
  • bdfff2b KTOR-10023 Throw BadRequestException on malformed URL segments
  • 7378949 KTOR-9986 Remove dot segments from relative redirect targets (#5939)
  • c981394 KTOR-9430 Fix test server stopping
  • Additional commits viewable in compare view

Updates io.ktor:ktor-server-netty from 3.6.0 to 3.6.1

Release notes

Sourced from io.ktor:ktor-server-netty's releases.

3.6.1

Published 29 October 2026

Improvements

  • KTOR-10005 Native accepted TCP sockets do not enable TCP_NODELAY, unlike JVM
  • KTOR-9966 Netty poor performance on delay calls
  • KTOR-4206 The "com.typesafe.config.ConfigException$Missing" exception leaks from the typesafe config library when configuration is merged

Bugfixes

  • KTOR-10037 CIO: keep-alive connection hangs when a response fails before writing any bytes
  • KTOR-9969 Kotlin/Native CIO server occasionally closes an accepted connection with zero response bytes under CPU load
  • KTOR-9974 CIO: close_notify is written concurrently with the last record, corrupting the TLS output and the kotlinx-io segment pool
  • KTOR-9925 Resources: Constant sibling route loses to parameterized one when routes are split across separate authenticate blocks
  • KTOR-9938 Apache5: streaming response hangs when the block returns before the body arrives
  • KTOR-10023 Ktor 3.6.0 no longer throws BadRequestException for malformed paths
  • KTOR-9986 HttpRedirect: a relative Location with dot segments is not normalized, so most engines send .. in the request path
  • KTOR-10085 ETags: Ignore If-Modified-Since when If-None-Match is present
  • KTOR-9430 DI: resources are not cleaned up during testing with testApplication
  • KTOR-7175 Ktor-client, connections leak
  • KTOR-9848 Android: The Android engine crashes with Unbalanced enter/exit on response read cancellation
  • KTOR-9994 Android engine closes RawSourceChannel on the main thread and crashes with NetworkOnMainThreadException
  • KTOR-9959 Sockets: CIO writer busy-loops when a nonblocking write returns zero
  • KTOR-9970 Java: Cancelling a request before response headers does not abort the HTTP exchange
  • KTOR-10006 OpenAPI: Compiler crash on local variable using object expression
  • KTOR-9972 Android: DiskReadViolation when KtorSimpleLogger is initialized during plugin execution
  • KTOR-9985 OpenAPI compiler plugin duplicates unrelated schemas (FooDTO -> FooDTO2) after adding new routes
  • KTOR-2348 DoubleReceive: recursive receive pipeline re-entry when receiving content in a receivePipeline interceptor
  • KTOR-9968 Test engine streaming responses hang when over 1MB
  • KTOR-9894 Netty + Compression: response leaked when the client disconnects before the body is written
  • KTOR-9987 WebSockets: Netty sometimes closes socket before sending close frame
  • KTOR-9943 HttpStatement.execute can hang when its block abandons a response body
  • KTOR-9980 CallLogging: MDC entries leak stale thread-local values when provider returns null
  • KTOR-9790 testApplication: sseSession() never returns when the SSE route installs a heartbeat
  • KTOR-9884 Directories are returned as empty binaries when using nested jars
  • KTOR-4245 Code snippet in Kdoc for DefaultRequest doesn't compile
  • KTOR-10035 WebSocket drops the queued Close frame when the server session fails
  • KTOR-10036 testApplication: WebSocket client stops reading before the servers Close reply arrives
Changelog

Sourced from io.ktor:ktor-server-netty's changelog.

3.6.1

Published 29 October 2026

Improvements

  • KTOR-10005 Native accepted TCP sockets do not enable TCP_NODELAY, unlike JVM
  • KTOR-9966 Netty poor performance on delay calls
  • KTOR-4206 The "com.typesafe.config.ConfigException$Missing" exception leaks from the typesafe config library when configuration is merged

Bugfixes

  • KTOR-10037 CIO: keep-alive connection hangs when a response fails before writing any bytes
  • KTOR-9969 Kotlin/Native CIO server occasionally closes an accepted connection with zero response bytes under CPU load
  • KTOR-9974 CIO: close_notify is written concurrently with the last record, corrupting the TLS output and the kotlinx-io segment pool
  • KTOR-9925 Resources: Constant sibling route loses to parameterized one when routes are split across separate authenticate blocks
  • KTOR-9938 Apache5: streaming response hangs when the block returns before the body arrives
  • KTOR-10023 Ktor 3.6.0 no longer throws BadRequestException for malformed paths
  • KTOR-9986 HttpRedirect: a relative Location with dot segments is not normalized, so most engines send .. in the request path
  • KTOR-10085 ETags: Ignore If-Modified-Since when If-None-Match is present
  • KTOR-9430 DI: resources are not cleaned up during testing with testApplication
  • KTOR-7175 Ktor-client, connections leak
  • KTOR-9848 Android: The Android engine crashes with Unbalanced enter/exit on response read cancellation
  • KTOR-9994 Android engine closes RawSourceChannel on the main thread and crashes with NetworkOnMainThreadException
  • KTOR-9959 Sockets: CIO writer busy-loops when a nonblocking write returns zero
  • KTOR-9970 Java: Cancelling a request before response headers does not abort the HTTP exchange
  • KTOR-10006 OpenAPI: Compiler crash on local variable using object expression
  • KTOR-9972 Android: DiskReadViolation when KtorSimpleLogger is initialized during plugin execution
  • KTOR-9985 OpenAPI compiler plugin duplicates unrelated schemas (FooDTO -> FooDTO2) after adding new routes
  • KTOR-2348 DoubleReceive: recursive receive pipeline re-entry when receiving content in a receivePipeline interceptor
  • KTOR-9968 Test engine streaming responses hang when over 1MB
  • KTOR-9894 Netty + Compression: response leaked when the client disconnects before the body is written
  • KTOR-9987 WebSockets: Netty sometimes closes socket before sending close frame
  • KTOR-9943 HttpStatement.execute can hang when its block abandons a response body
  • KTOR-9980 CallLogging: MDC entries leak stale thread-local values when provider returns null
  • KTOR-9790 testApplication: sseSession() never returns when the SSE route installs a heartbeat
  • KTOR-9884 Directories are returned as empty binaries when using nested jars
  • KTOR-4245 Code snippet in Kdoc for DefaultRequest doesn't compile
  • KTOR-10035 WebSocket drops the queued Close frame when the server session fails
  • KTOR-10036 testApplication: WebSocket client stops reading before the servers Close reply arrives
Commits
  • 26cc003 Release 3.6.1 (#5970)
  • b4fc04d KTOR-10035 Deliver the queued Close frame when the session fails (#5959)
  • fbd2a80 KTOR-10036 Keep the test host WebSocket client reading until the server close...
  • 516fe19 KTOR-10037 Close the CIO connection when a response fails before writing any ...
  • 3954d0c KTOR-9938: Abort Apache5 exchanges when the response body is cancelled
  • dbc9692 KTOR-9969 Shut down native socket output inside the writer coroutine
  • 3ceecd7 KTOR-9992 Fix CIO accept busy loop (#5961)
  • bdfff2b KTOR-10023 Throw BadRequestException on malformed URL segments
  • 7378949 KTOR-9986 Remove dot segments from relative redirect targets (#5939)
  • c981394 KTOR-9430 Fix test server stopping
  • Additional commits viewable in compare view

Updates io.ktor:ktor-server-status-pages from 3.6.0 to 3.6.1

Release notes

Sourced from io.ktor:ktor-server-status-pages's releases.

3.6.1

Published 29 October 2026

Improvements

  • KTOR-10005 Native accepted TCP sockets do not enable TCP_NODELAY, unlike JVM
  • KTOR-9966 Netty poor performance on delay calls
  • KTOR-4206 The "com.typesafe.config.ConfigException$Missing" exception leaks from the typesafe config library when configuration is merged

Bugfixes

  • KTOR-10037 CIO: keep-alive connection hangs when a response fails before writing any bytes
  • KTOR-9969 Kotlin/Native CIO server occasionally closes an accepted connection with zero response bytes under CPU load
  • KTOR-9974 CIO: close_notify is written concurrently with the last record, corrupting the TLS output and the kotlinx-io segment pool
  • KTOR-9925 Resources: Constant sibling route loses to parameterized one when routes are split across separate authenticate blocks
  • KTOR-9938 Apache5: streaming response hangs when the block returns before the body arrives
  • KTOR-10023 Ktor 3.6.0 no longer throws BadRequestException for malformed paths
  • KTOR-9986 HttpRedirect: a relative Location with dot segments is not normalized, so most engines send .. in the request path
  • KTOR-10085 ETags: Ignore If-Modified-Since when If-None-Match is present
  • KTOR-9430 DI: resources are not cleaned up during testing with testApplication
  • KTOR-7175 Ktor-client, connections leak
  • KTOR-9848 Android: The Android engine crashes with Unbalanced enter/exit on response read cancellation
  • KTOR-9994 Android engine closes RawSourceChannel on the main thread and crashes with NetworkOnMainThreadException
  • KTOR-9959 Sockets: CIO writer busy-loops when a nonblocking write returns zero
  • KTOR-9970 Java: Cancelling a request before response headers does not abort the HTTP exchange
  • KTOR-10006 OpenAPI: Compiler crash on local variable using object expression
  • KTOR-9972 Android: DiskReadViolation when KtorSimpleLogger is initialized during plugin execution
  • KTOR-9985 OpenAPI compiler plugin duplicates unrelated schemas (FooDTO -> FooDTO2) after adding new routes
  • KTOR-2348 DoubleReceive: recursive receive pipeline re-entry when receiving content in a receivePipeline interceptor
  • KTOR-9968 Test engine streaming responses hang when over 1MB
  • KTOR-9894 Netty + Compression: response leaked when the client disconnects before the body is written
  • KTOR-9987 WebSockets: Netty sometimes closes socket before sending close frame
  • KTOR-9943 HttpStatement.execute can hang when its block abandons a response body
  • KTOR-9980 CallLogging: MDC entries leak stale thread-local values when provider returns null
  • KTOR-9790 testApplication: sseSession() never returns when the SSE route installs a heartbeat
  • KTOR-9884 Directories are returned as empty binaries when using nested jars
  • KTOR-4245 Code snippet in Kdoc for DefaultRequest doesn't compile
  • KTOR-10035 WebSocket drops the queued Close frame when the server session fails
  • KTOR-10036 testApplication: WebSocket client stops reading before the servers Close reply arrives
Changelog

Sourced from io.ktor:ktor-server-status-pages's changelog.

3.6.1

Published 29 October 2026

Improvements

  • KTOR-10005 Native accepted TCP sockets do not enable TCP_NODELAY, unlike JVM
  • KTOR-9966 Netty poor performance on delay calls
  • KTOR-4206 The "com.typesafe.config.ConfigException$Missing" exception leaks from the typesafe config library when configuration is merged

Bugfixes

  • KTOR-10037 CIO: keep-alive connection hangs when a response fails before writing any bytes
  • KTOR-9969 Kotlin/Native CIO server occasionally closes an accepted connection with zero response bytes under CPU load
  • KTOR-9974 CIO: close_notify is written concurrently with the last record, corrupting the TLS output and the kotlinx-io segment pool
  • KTOR-9925 Resources: Constant sibling route loses to parameterized one when routes are split across separate authenticate blocks
  • KTOR-9938 Apache5: streaming response hangs when the block returns before the body arrives
  • KTOR-10023 Ktor 3.6.0 no longer throws BadRequestException for malformed paths
  • KTOR-9986 HttpRedirect: a relative Location with dot segments is not normalized, so most engines send .. in the request path
  • KTOR-10085 ETags: Ignore If-Modified-Since when If-None-Match is present
  • KTOR-9430 DI: resources are not cleaned up during testing with testApplication
  • KTOR-7175 Ktor-client, connections leak
  • KTOR-9848 Android: The Android engine crashes with Unbalanced enter/exit on response read cancellation
  • KTOR-9994 Android engine closes RawSourceChannel on the main thread and crashes with NetworkOnMainThreadException

@dependabot
Bump the deps group with 9 updates
bbde4ae 
Bumps the deps group with 9 updates:

| Package | From | To |
| --- | --- | --- |
| [net.bytebuddy:byte-buddy-agent](https://github.com/raphw/byte-buddy) | `1.18.15` | `1.18.16` |
| [com.google.code.gson:gson](https://github.com/google/gson) | `2.14.0` | `2.15.0` |
| [ch.qos.logback:logback-classic](https://github.com/qos-ch/logback) | `1.6.5` | `1.6.6` |
| [se.bjurr.violations:violations-lib](https://github.com/tomasbjerre/violations-lib) | `3.0.2` | `3.0.3` |
| [io.ktor:ktor-server-core](https://github.com/ktorio/ktor) | `3.6.0` | `3.6.1` |
| [io.ktor:ktor-server-netty](https://github.com/ktorio/ktor) | `3.6.0` | `3.6.1` |
| [io.ktor:ktor-server-status-pages](https://github.com/ktorio/ktor) | `3.6.0` | `3.6.1` |
| [io.ktor:ktor-server-html-builder](https://github.com/ktorio/ktor) | `3.6.0` | `3.6.1` |
| [org.graalvm.buildtools.native](https://github.com/graalvm/native-build-tools) | `1.1.16` | `1.1.18` |


Updates `net.bytebuddy:byte-buddy-agent` from 1.18.15 to 1.18.16
- [Release notes](https://github.com/raphw/byte-buddy/releases)
- [Changelog](https://github.com/raphw/byte-buddy/blob/master/release-notes.md)
- [Commits](raphw/byte-buddy@byte-buddy-1.18.15...byte-buddy-1.18.16)

Updates `com.google.code.gson:gson` from 2.14.0 to 2.15.0
- [Release notes](https://github.com/google/gson/releases)
- [Changelog](https://github.com/google/gson/blob/main/CHANGELOG.md)
- [Commits](google/gson@gson-parent-2.14.0...gson-parent-2.15.0)

Updates `ch.qos.logback:logback-classic` from 1.6.5 to 1.6.6
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](qos-ch/logback@v_1.6.5...v_1.6.6)

Updates `se.bjurr.violations:violations-lib` from 3.0.2 to 3.0.3
- [Release notes](https://github.com/tomasbjerre/violations-lib/releases)
- [Changelog](https://github.com/tomasbjerre/violations-lib/blob/master/CHANGELOG.md)
- [Commits](tomasbjerre/violations-lib@3.0.2...3.0.3)

Updates `io.ktor:ktor-server-core` from 3.6.0 to 3.6.1
- [Release notes](https://github.com/ktorio/ktor/releases)
- [Changelog](https://github.com/ktorio/ktor/blob/3.6.1/CHANGELOG.md)
- [Commits](ktorio/ktor@3.6.0...3.6.1)

Updates `io.ktor:ktor-server-netty` from 3.6.0 to 3.6.1
- [Release notes](https://github.com/ktorio/ktor/releases)
- [Changelog](https://github.com/ktorio/ktor/blob/3.6.1/CHANGELOG.md)
- [Commits](ktorio/ktor@3.6.0...3.6.1)

Updates `io.ktor:ktor-server-status-pages` from 3.6.0 to 3.6.1
- [Release notes](https://github.com/ktorio/ktor/releases)
- [Changelog](https://github.com/ktorio/ktor/blob/3.6.1/CHANGELOG.md)
- [Commits](ktorio/ktor@3.6.0...3.6.1)

Updates `io.ktor:ktor-server-html-builder` from 3.6.0 to 3.6.1
- [Release notes](https://github.com/ktorio/ktor/releases)
- [Changelog](https://github.com/ktorio/ktor/blob/3.6.1/CHANGELOG.md)
- [Commits](ktorio/ktor@3.6.0...3.6.1)

Updates `io.ktor:ktor-server-netty` from 3.6.0 to 3.6.1
- [Release notes](https://github.com/ktorio/ktor/releases)
- [Changelog](https://github.com/ktorio/ktor/blob/3.6.1/CHANGELOG.md)
- [Commits](ktorio/ktor@3.6.0...3.6.1)

Updates `io.ktor:ktor-server-status-pages` from 3.6.0 to 3.6.1
- [Release notes](https://github.com/ktorio/ktor/releases)
- [Changelog](https://github.com/ktorio/ktor/blob/3.6.1/CHANGELOG.md)
- [Commits](ktorio/ktor@3.6.0...3.6.1)

Updates `io.ktor:ktor-server-html-builder` from 3.6.0 to 3.6.1
- [Release notes](https://github.com/ktorio/ktor/releases)
- [Changelog](https://github.com/ktorio/ktor/blob/3.6.1/CHANGELOG.md)
- [Commits](ktorio/ktor@3.6.0...3.6.1)

Updates `org.graalvm.buildtools.native` from 1.1.16 to 1.1.18
- [Release notes](https://github.com/graalvm/native-build-tools/releases)
- [Commits](graalvm/native-build-tools@1.1.16...1.1.18)

---
updated-dependencies:
- dependency-name: net.bytebuddy:byte-buddy-agent
  dependency-version: 1.18.16
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: deps
- dependency-name: com.google.code.gson:gson
  dependency-version: 2.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: deps
- dependency-name: ch.qos.logback:logback-classic
  dependency-version: 1.6.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: deps
- dependency-name: se.bjurr.violations:violations-lib
  dependency-version: 3.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: deps
- dependency-name: io.ktor:ktor-server-core
  dependency-version: 3.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: deps
- dependency-name: io.ktor:ktor-server-netty
  dependency-version: 3.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: deps
- dependency-name: io.ktor:ktor-server-status-pages
  dependency-version: 3.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: deps
- dependency-name: io.ktor:ktor-server-html-builder
  dependency-version: 3.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: deps
- dependency-name: io.ktor:ktor-server-netty
  dependency-version: 3.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: deps
- dependency-name: io.ktor:ktor-server-status-pages
  dependency-version: 3.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: deps
- dependency-name: io.ktor:ktor-server-html-builder
  dependency-version: 3.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: deps
- dependency-name: org.graalvm.buildtools.native
  dependency-version: 1.1.18
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: deps
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update java code labels Nov 1, 2026
@github-code-quality

github-code-quality Bot commented Nov 1, 2026

Copy link
Copy Markdown
Contributor

Code coverage overview

Languages: Java

Java / code-coverage/jacoco-ubuntu-latest-21

main 24f0f30 dependabot/gradle/de... bbde4ae +/-
59% 59% 0%

ℹ️ Calculations represent line coverage. Results may change as calculations are updated.

@dependabot @github

dependabot Bot commented on behalf of github Nov 2, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Nov 2, 2026
@dependabot
dependabot Bot deleted the dependabot/gradle/deps-3d016c1a6d branch November 2, 2026 21:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants