dependabot[bot] opened a new pull request, #77043: URL: https://github.com/apache/airflow/pull/77043
Bumps the java-sdk-dependency-updates group with 8 updates in the /java-sdk directory: | Package | From | To | | --- | --- | --- | | [com.google.testing.compile:compile-testing](https://github.com/google/compile-testing) | `0.23.0` | `0.24.0` | | [com.github.spotbugs:spotbugs-annotations](https://github.com/spotbugs/spotbugs) | `4.10.4` | `4.10.5` | | [io.ktor:ktor-network](https://github.com/ktorio/ktor) | `3.6.0` | `3.6.1` | | [org.jetbrains.kotlinx:kotlinx-serialization-json](https://github.com/Kotlin/kotlinx.serialization) | `1.11.0` | `1.12.0` | | [com.squareup.okhttp3:mockwebserver](https://github.com/square/okhttp) | `4.12.0` | `4.12.1` | | [plugin.serialization](https://github.com/JetBrains/kotlin) | `2.4.20` | `2.4.21` | | [org.jetbrains.kotlin:kotlin-gradle-plugin](https://github.com/JetBrains/kotlin) | `2.4.20` | `2.4.21` | | [gradle-wrapper](https://github.com/gradle/gradle) | `8.14.5` | `8.14.6` | Updates `com.google.testing.compile:compile-testing` from 0.23.0 to 0.24.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/compile-testing/releases";>com.google.testing.compile:compile-testing's releases</a>.</em></p> <blockquote> <h2>v0.24.0</h2> <ul> <li>Fixed Java 8 build configuration to work for downstream users of Maven 3.10.0. (63b2b79)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/google/compile-testing/commit/52534e3c6a554e0496f95397303812592de42469";><code>52534e3</code></a> Set version number for compile-testing to 0.24.0.</li> <li><a href="https://github.com/google/compile-testing/commit/63b2b794f03bc6eb26c2f73ac7710c4aeace223f";><code>63b2b79</code></a> Fix issue for downstream users of Maven 3.10.0, and clean up obsolete profile.</li> <li><a href="https://github.com/google/compile-testing/commit/bd7fa05b0d6347abd4cf259b763c085e294ddf07";><code>bd7fa05</code></a> Bump actions/setup-java from 6.0.0 to 6.0.1 in the github-actions group</li> <li><a href="https://github.com/google/compile-testing/commit/e52ff3db09c97ca6f514591a1cc89846f27856c1";><code>e52ff3d</code></a> Bump Guava to 33.7.2.</li> <li><a href="https://github.com/google/compile-testing/commit/f16e0868f6e1524a6e981ab7537d050b94ce0556";><code>f16e086</code></a> Format some Markdown.</li> <li><a href="https://github.com/google/compile-testing/commit/fb0fe9c9bb848c5a6f5aad1697067e5b74ca9078";><code>fb0fe9c</code></a> Bump the dependencies group with 2 updates</li> <li><a href="https://github.com/google/compile-testing/commit/f4f9176363198344b6d25ada3df3d12f71a814f1";><code>f4f9176</code></a> Bump actions/setup-java from 5.6.0 to 6.0.0 in the github-actions group</li> <li><a href="https://github.com/google/compile-testing/commit/2e1523abae2b617ff49764f31a0b7651c4326eea";><code>2e1523a</code></a> Bump Guava to 33.7.1.</li> <li><a href="https://github.com/google/compile-testing/commit/05fb3dda38cd175039e2604c4f92726439e3c057";><code>05fb3dd</code></a> Bump Guava to 33.7.0.</li> <li><a href="https://github.com/google/compile-testing/commit/add841bee5341e9dc18f52a30fbd8d8c4bcdaa58";><code>add841b</code></a> Update links from the legacy search.maven.org to the new central.sonatype.com.</li> <li>Additional commits viewable in <a href="https://github.com/google/compile-testing/compare/v0.23.0...v0.24.0";>compare view</a></li> </ul> </details> <br /> Updates `com.github.spotbugs:spotbugs-annotations` from 4.10.4 to 4.10.5 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/spotbugs/spotbugs/releases";>com.github.spotbugs:spotbugs-annotations's releases</a>.</em></p> <blockquote> <h2>4.10.5</h2> <p>SpotBugs 4.10.5</p> <h3>CHANGELOG</h3> <h3>Added</h3> <ul> <li>Add <code>ReflectiveAccessTracker</code> to track fields accessed via reflection - such as VarHandle, MethodHandle or AtomicFieldUpdaters (<a href="https://redirect.github.com/spotbugs/spotbugs/pull/3954";>#3954</a>) to fix issue (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/2749";>#2749</a>)</li> <li>Add automatic completion of class names in GUI class filter (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/749";>#749</a>)</li> </ul> <h3>Changed</h3> <ul> <li><code>@SuppressFBWarnings</code> annotation on a method or a constructor now suppresses warnings reported in their lambdas too (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/724";>#724</a>)</li> <li>Replace deprecated calls to 'SignatureParser' to 'GenericSignatureParser' where feasible (<a href="https://redirect.github.com/spotbugs/spotbugs/pull/4337";>#4336</a>)</li> <li>Declaring to the interface lists/maps (<a href="https://redirect.github.com/spotbugs/spotbugs/pull/4381";>#4381</a>)</li> </ul> <h3>Fixed</h3> <ul> <li>Fix <code>NP_NULL_ON_SOME_PATH</code> false positive when a field null check that throws uses <code>field == null</code> but not <code>null == field</code> (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4147";>#4147</a>)</li> <li>Fix <code>RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT</code> false negative when the ignored result comes from <code>Arrays.copyOf</code>, <code>Arrays.copyOfRange</code> or any pure static method or constructor of a class using <code>assert</code> (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/3900";>#3900</a>)</li> <li>Fix <code>AA_ASSERTION_OF_ARGUMENTS</code> false negative when a public method validates a parameter with <code>assert</code> and <code>instanceof</code> (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4305";>#4305</a>)</li> <li>Fix <code>PT_ABSOLUTE_PATH_TRAVERSAL</code> false negative for <code>new File(parent, child)</code>, where the attacker controlled segment is the second argument (<a href="https://redirect.github.com/spotbugs/spotbugs/pull/4340";>#4340</a>)</li> <li>Fix 'DM_USELESS_THREAD' false negative for Thread subclasses that do not override run() (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4306";>#4306</a>)</li> <li>Fix <code>UL_UNRELEASED_LOCK</code> false negative when a method acquires a lock and never calls <code>unlock</code> (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4310";>#4310</a>)</li> <li>Fix <code>TLW_TWO_LOCK_WAIT</code> false negatives when a class waits while holding two monitors but has no matching <code>notify()</code> call (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4323";>#4323</a>)</li> <li>Fix <code>NP_ALWAYS_NULL</code> false positives when a non-null value is known to satisfy an <code>instanceof</code> check (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4272";>#4272</a>)</li> <li>Fix <code>RANGE_ARRAY_INDEX</code> false positive when the array access is inside unreachable code caused by an impossible null condition (e.g. <code>if (x == null && x != null)</code>) (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4275";>#4275</a>)</li> <li>Fix <code>NP_NULL_ON_SOME_PATH</code> false positive when <code>instanceof</code> check is always true because the value was created with <code>new</code> and its exact type is a subtype of the checked type (e.g. <code>Base value = new Derived(); if (value instanceof Derived) result = new Object(); result.toString()</code>) (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4273";>#4273</a>)</li> <li>Fix <code>NN_NAKED_NOTIFY</code> false positive when guarded state is updated before the synchronized block that calls <code>notify</code>/<code>notifyAll</code> (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/3786";>#3786</a>)</li> <li>Fix <code>SA_LOCAL_SELF_ASSIGNMENT</code> false positive in methods with <code>++</code>/<code>--</code> inside a switch nested in a try-catch block (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/3929";>#3929</a>)</li> <li>Fix <code>AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE</code> false negative for non-atomic read-modify-write in inner classes accessing enclosing shared fields (<a href="https://redirect.github.com/spotbugs/spotbugs/pull/4236";>#4236</a>)</li> <li>Fix <code>OS_OPEN_STREAM</code> false positive when the result of <code>PrintWriter.append()</code> is reassigned before closing the writer (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4274";>#4274</a>)</li> <li>Fix <code>OS_OPEN_STREAM</code> false positive when a stream is wrapped (e.g. in a <code>PrintStream</code>, <code>BufferedOutputStream</code> or <code>PrintWriter</code>) and the wrapped stream is closed instead of the wrapper (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4304";>#4304</a>)</li> <li>Fix <code>SING_SINGLETON_GETTER_NOT_SYNCHRONIZED</code> false negative when lazy init uses a ternary assignment instead of an <code>if</code> statement (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4154";>#4154</a>)</li> <li>Fix <code>UR_UNINIT_READ</code> false negative for compound assignment to a field (e.g. <code>m_iType |= e</code>) (<a href="https://redirect.github.com/spotbugs/spotbugs/pull/4233";>#4233</a>)</li> <li>Fix <code>NP_BOOLEAN_RETURN_NULL</code> false negative when <code>null</code> is returned via a local variable (<a href="https://redirect.github.com/spotbugs/spotbugs/pull/4234";>#4234</a>)</li> <li>Fix <code>MS_EXPOSE_BUF</code> and <code>EI_EXPOSE_BUF</code> false negative when returning <code>Buffer.array()</code> (<a href="https://redirect.github.com/spotbugs/spotbugs/pull/4235";>#4235</a>)</li> <li>Fix <code>OBL_UNSATISFIED_OBLIGATION</code> false negatives for unclosed <code>CallableStatement</code>s returned by <code>Connection.prepareCall</code> (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4148";>#4148</a>)</li> <li>Fix <code>LI_LAZY_INIT_STATIC</code> false negative when field is lazily initialized using a method call (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4276";>#4276</a>)</li> <li>Fix <code>DMI_RANDOM_USED_ONLY_ONCE</code> FP when Random is used inside loop but created before (<a href="https://redirect.github.com/spotbugs/spotbugs/pull/3937";>#3937</a>)</li> <li>Fix SARIF output writing source-location URI syntax exceptions to stderr when source filenames are unknown (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/1412";>#1412</a>)</li> <li>Fix IL_INFINITE_LOOP false positives for loops with conditions that are statically known to be true or false (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/3904";>#3904</a>)</li> <li>Narrow the definition of singletons (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/2985";>#2985</a>)</li> <li>Fix <code>NP_LOAD_OF_KNOWN_NULL_VALUE</code> false negative when null check uses <code>instanceof</code> (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/3916";>#3916</a>)</li> <li>Fix <code>MC_OVERRIDABLE_METHOD_CALL_IN_CONSTRUCTOR</code> false negative when a constructor calls an overridable method that takes arguments, such as a setter (e.g. <code>setValue(value)</code>) (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4309";>#4309</a>)</li> <li>Fix CLI launcher scripts intercepting <code>-conserveSpace</code> with a JVM system property instead passing it to Java Application as equivalent to <code>-effort:min</code> (<a href="https://redirect.github.com/spotbugs/spotbugs/pull/4289";>#4268</a>)</li> <li>Fix <code>USO_UNSAFE_ACCESSIBLE_OBJECT_SYNCHRONIZATION</code> false positive when <code>clone()</code> assigns a newly created lock object to the copy (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4320";>#4320</a>)</li> <li>Fix <code>CT_CONSTRUCTOR_THROW</code> false positive with sealed classes (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4259";>#4259</a>)</li> <li>Fix <code>JrtfsCodeBase</code> resolving JDK classes from the module image of the running JVM instead of the JDK the given <code>jrt-fs.jar</code> belongs to, so that <code>-auxclasspath <other-jdk>/lib/jrt-fs.jar</code> is honoured (<a href="https://redirect.github.com/spotbugs/spotbugs/pull/4329";>#4329</a>)</li> <li>Fix <code>USO_UNSAFE_ACCESSIBLE_OBJECT_SYNCHRONIZATION</code> false positive when a lock is assigned to a newly allocated object (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4331";>#4331</a>)</li> <li>Do not flag <code>writeReplace()</code> and <code>writeExternal()</code> as mutators (<a href="https://redirect.github.com/spotbugs/spotbugs/pull/1719";>#1719</a>)</li> <li>Prevent XML external entity resolution in user-controlled data (<a href="https://redirect.github.com/spotbugs/spotbugs/pull/4365";>#4365</a>)</li> <li>Fix handling of JSpecify type-use annotations in <code>CheckRelaxingNullnessAnnotation</code> (<a href="https://redirect.github.com/spotbugs/spotbugs/pull/4389";>#4389</a>)</li> <li>Stop reporting missing java.applet at java 26 or higher (<a href="https://redirect.github.com/spotbugs/spotbugs/pull/4390";>#4390</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/spotbugs/spotbugs/blob/master/CHANGELOG.md";>com.github.spotbugs:spotbugs-annotations's changelog</a>.</em></p> <blockquote> <h2>4.10.5 - 2026-10-11</h2> <h3>Added</h3> <ul> <li>Add <code>ReflectiveAccessTracker</code> to track fields accessed via reflection - such as VarHandle, MethodHandle or AtomicFieldUpdaters (<a href="https://redirect.github.com/spotbugs/spotbugs/pull/3954";>#3954</a>) to fix issue (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/2749";>#2749</a>)</li> <li>Add automatic completion of class names in GUI class filter (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/749";>#749</a>)</li> </ul> <h3>Changed</h3> <ul> <li><code>@SuppressFBWarnings</code> annotation on a method or a constructor now suppresses warnings reported in their lambdas too (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/724";>#724</a>)</li> <li>Replace deprecated calls to 'SignatureParser' to 'GenericSignatureParser' where feasible (<a href="https://redirect.github.com/spotbugs/spotbugs/pull/4337";>#4336</a>)</li> <li>Declaring to the interface lists/maps (<a href="https://redirect.github.com/spotbugs/spotbugs/pull/4381";>#4381</a>)</li> </ul> <h3>Fixed</h3> <ul> <li>Fix <code>NP_NULL_ON_SOME_PATH</code> false positive when a field null check that throws uses <code>field == null</code> but not <code>null == field</code> (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4147";>#4147</a>)</li> <li>Fix <code>RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT</code> false negative when the ignored result comes from <code>Arrays.copyOf</code>, <code>Arrays.copyOfRange</code> or any pure static method or constructor of a class using <code>assert</code> (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/3900";>#3900</a>)</li> <li>Fix <code>AA_ASSERTION_OF_ARGUMENTS</code> false negative when a public method validates a parameter with <code>assert</code> and <code>instanceof</code> (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4305";>#4305</a>)</li> <li>Fix <code>PT_ABSOLUTE_PATH_TRAVERSAL</code> false negative for <code>new File(parent, child)</code>, where the attacker controlled segment is the second argument (<a href="https://redirect.github.com/spotbugs/spotbugs/pull/4340";>#4340</a>)</li> <li>Fix 'DM_USELESS_THREAD' false negative for Thread subclasses that do not override run() (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4306";>#4306</a>)</li> <li>Fix <code>UL_UNRELEASED_LOCK</code> false negative when a method acquires a lock and never calls <code>unlock</code> (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4310";>#4310</a>)</li> <li>Fix <code>TLW_TWO_LOCK_WAIT</code> false negatives when a class waits while holding two monitors but has no matching <code>notify()</code> call (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4323";>#4323</a>)</li> <li>Fix <code>NP_ALWAYS_NULL</code> false positives when a non-null value is known to satisfy an <code>instanceof</code> check (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4272";>#4272</a>)</li> <li>Fix <code>RANGE_ARRAY_INDEX</code> false positive when the array access is inside unreachable code caused by an impossible null condition (e.g. <code>if (x == null && x != null)</code>) (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4275";>#4275</a>)</li> <li>Fix <code>NP_NULL_ON_SOME_PATH</code> false positive when <code>instanceof</code> check is always true because the value was created with <code>new</code> and its exact type is a subtype of the checked type (e.g. <code>Base value = new Derived(); if (value instanceof Derived) result = new Object(); result.toString()</code>) (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4273";>#4273</a>)</li> <li>Fix <code>NN_NAKED_NOTIFY</code> false positive when guarded state is updated before the synchronized block that calls <code>notify</code>/<code>notifyAll</code> (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/3786";>#3786</a>)</li> <li>Fix <code>SA_LOCAL_SELF_ASSIGNMENT</code> false positive in methods with <code>++</code>/<code>--</code> inside a switch nested in a try-catch block (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/3929";>#3929</a>)</li> <li>Fix <code>AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE</code> false negative for non-atomic read-modify-write in inner classes accessing enclosing shared fields (<a href="https://redirect.github.com/spotbugs/spotbugs/pull/4236";>#4236</a>)</li> <li>Fix <code>OS_OPEN_STREAM</code> false positive when the result of <code>PrintWriter.append()</code> is reassigned before closing the writer (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4274";>#4274</a>)</li> <li>Fix <code>OS_OPEN_STREAM</code> false positive when a stream is wrapped (e.g. in a <code>PrintStream</code>, <code>BufferedOutputStream</code> or <code>PrintWriter</code>) and the wrapped stream is closed instead of the wrapper (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4304";>#4304</a>)</li> <li>Fix <code>SING_SINGLETON_GETTER_NOT_SYNCHRONIZED</code> false negative when lazy init uses a ternary assignment instead of an <code>if</code> statement (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4154";>#4154</a>)</li> <li>Fix <code>UR_UNINIT_READ</code> false negative for compound assignment to a field (e.g. <code>m_iType |= e</code>) (<a href="https://redirect.github.com/spotbugs/spotbugs/pull/4233";>#4233</a>)</li> <li>Fix <code>NP_BOOLEAN_RETURN_NULL</code> false negative when <code>null</code> is returned via a local variable (<a href="https://redirect.github.com/spotbugs/spotbugs/pull/4234";>#4234</a>)</li> <li>Fix <code>MS_EXPOSE_BUF</code> and <code>EI_EXPOSE_BUF</code> false negative when returning <code>Buffer.array()</code> (<a href="https://redirect.github.com/spotbugs/spotbugs/pull/4235";>#4235</a>)</li> <li>Fix <code>OBL_UNSATISFIED_OBLIGATION</code> false negatives for unclosed <code>CallableStatement</code>s returned by <code>Connection.prepareCall</code> (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4148";>#4148</a>)</li> <li>Fix <code>LI_LAZY_INIT_STATIC</code> false negative when field is lazily initialized using a method call (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4276";>#4276</a>)</li> <li>Fix <code>DMI_RANDOM_USED_ONLY_ONCE</code> FP when Random is used inside loop but created before (<a href="https://redirect.github.com/spotbugs/spotbugs/pull/3937";>#3937</a>)</li> <li>Fix SARIF output writing source-location URI syntax exceptions to stderr when source filenames are unknown (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/1412";>#1412</a>)</li> <li>Fix IL_INFINITE_LOOP false positives for loops with conditions that are statically known to be true or false (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/3904";>#3904</a>)</li> <li>Narrow the definition of singletons (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/2985";>#2985</a>)</li> <li>Fix <code>NP_LOAD_OF_KNOWN_NULL_VALUE</code> false negative when null check uses <code>instanceof</code> (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/3916";>#3916</a>)</li> <li>Fix <code>MC_OVERRIDABLE_METHOD_CALL_IN_CONSTRUCTOR</code> false negative when a constructor calls an overridable method that takes arguments, such as a setter (e.g. <code>setValue(value)</code>) (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4309";>#4309</a>)</li> <li>Fix CLI launcher scripts intercepting <code>-conserveSpace</code> with a JVM system property instead passing it to Java Application as equivalent to <code>-effort:min</code> (<a href="https://redirect.github.com/spotbugs/spotbugs/pull/4289";>#4268</a>)</li> <li>Fix <code>USO_UNSAFE_ACCESSIBLE_OBJECT_SYNCHRONIZATION</code> false positive when <code>clone()</code> assigns a newly created lock object to the copy (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4320";>#4320</a>)</li> <li>Fix <code>CT_CONSTRUCTOR_THROW</code> false positive with sealed classes (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4259";>#4259</a>)</li> <li>Fix <code>JrtfsCodeBase</code> resolving JDK classes from the module image of the running JVM instead of the JDK the given <code>jrt-fs.jar</code> belongs to, so that <code>-auxclasspath <other-jdk>/lib/jrt-fs.jar</code> is honoured (<a href="https://redirect.github.com/spotbugs/spotbugs/pull/4329";>#4329</a>)</li> <li>Fix <code>USO_UNSAFE_ACCESSIBLE_OBJECT_SYNCHRONIZATION</code> false positive when a lock is assigned to a newly allocated object (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4331";>#4331</a>)</li> <li>Do not flag <code>writeReplace()</code> and <code>writeExternal()</code> as mutators (<a href="https://redirect.github.com/spotbugs/spotbugs/pull/1719";>#1719</a>)</li> <li>Prevent XML external entity resolution in user-controlled data (<a href="https://redirect.github.com/spotbugs/spotbugs/pull/4365";>#4365</a>)</li> <li>Fix handling of JSpecify type-use annotations in <code>CheckRelaxingNullnessAnnotation</code> (<a href="https://redirect.github.com/spotbugs/spotbugs/pull/4389";>#4389</a>)</li> <li>Stop reporting missing java.applet at java 26 or higher (<a href="https://redirect.github.com/spotbugs/spotbugs/pull/4390";>#4390</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/spotbugs/spotbugs/commit/6816eb256805aa6eed1dced23e6a4aea08cc6660";><code>6816eb2</code></a> release v4.10.5</li> <li><a href="https://github.com/spotbugs/spotbugs/commit/6d4cc6820a6dcb49f8b65ff44fe635345bfd20a9";><code>6d4cc68</code></a> chore(tests): Migrate further to jspecify for Nonnull/Nullable in tests (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4392";>#4392</a>)</li> <li><a href="https://github.com/spotbugs/spotbugs/commit/fd4200bb41a817f58a401db68fb663c8a592fc9d";><code>fd4200b</code></a> chore(tests): Migrate further to jspecify for Nonnull/Nullable in tests (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4391";>#4391</a>)</li> <li><a href="https://github.com/spotbugs/spotbugs/commit/c29dd08cf02092a44d9b818dcc3bdd66d5b007a0";><code>c29dd08</code></a> chore(fix): Stop reporting missing java.applet at java 26 or higher (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4390";>#4390</a>)</li> <li><a href="https://github.com/spotbugs/spotbugs/commit/7f809fcc8e86085d3fd948b717fb521ff8446316";><code>7f809fc</code></a> Fix handling of JSpecify type-use annotations in `CheckRelaxingNullnessAnnota...</li> <li><a href="https://github.com/spotbugs/spotbugs/commit/8a1f6f9cd0a0aab07591f8491b6bd12963599cc7";><code>8a1f6f9</code></a> fix(deps): update asm to v9.11 (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4388";>#4388</a>)</li> <li><a href="https://github.com/spotbugs/spotbugs/commit/d2de0a3ac5ae92f6cf308139e013459c0f4101b5";><code>d2de0a3</code></a> chore(deps): update dependency com.diffplug.spotless:spotless-plugin-gradle t...</li> <li><a href="https://github.com/spotbugs/spotbugs/commit/0b846571cecf8810ee372becee9ceb7b3b6c972d";><code>0b84657</code></a> chore(deps): update plugin com.diffplug.spotless to v8.10.4 (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4387";>#4387</a>)</li> <li><a href="https://github.com/spotbugs/spotbugs/commit/9442ed21de94472d56f4925d13ff18e141ed3f3f";><code>9442ed2</code></a> fix(deps): update dependency org.checkerframework:checker-qual to v4.3.1 (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4385";>#4385</a>)</li> <li><a href="https://github.com/spotbugs/spotbugs/commit/c359ba332a27d8e80fd3656e03b76a57be843bc9";><code>c359ba3</code></a> chore(cleanup): Minor cleanup (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4384";>#4384</a>)</li> <li>Additional commits viewable in <a href="https://github.com/spotbugs/spotbugs/compare/4.10.4...4.10.5";>compare view</a></li> </ul> </details> <br /> Updates `io.ktor:ktor-network` from 3.6.0 to 3.6.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/ktorio/ktor/releases";>io.ktor:ktor-network's releases</a>.</em></p> <blockquote> <h2>3.6.1</h2> <blockquote> <p>Published 29 October 2026</p> </blockquote> <h3>Improvements</h3> <ul> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-10005";>KTOR-10005</a> Native accepted TCP sockets do not enable TCP_NODELAY, unlike JVM</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9966";>KTOR-9966</a> Netty poor performance on delay calls</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-4206";>KTOR-4206</a> The "com.typesafe.config.ConfigException$Missing" exception leaks from the typesafe config library when configuration is merged</li> </ul> <h3>Bugfixes</h3> <ul> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-10037";>KTOR-10037</a> CIO: keep-alive connection hangs when a response fails before writing any bytes</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9969";>KTOR-9969</a> Kotlin/Native CIO server occasionally closes an accepted connection with zero response bytes under CPU load</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9974";>KTOR-9974</a> CIO: close_notify is written concurrently with the last record, corrupting the TLS output and the kotlinx-io segment pool</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9925";>KTOR-9925</a> Resources: Constant sibling route loses to parameterized one when routes are split across separate authenticate blocks</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9938";>KTOR-9938</a> Apache5: streaming response hangs when the block returns before the body arrives</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-10023";>KTOR-10023</a> Ktor 3.6.0 no longer throws BadRequestException for malformed paths</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9986";>KTOR-9986</a> HttpRedirect: a relative Location with dot segments is not normalized, so most engines send <code>..</code> in the request path</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-10085";>KTOR-10085</a> ETags: Ignore If-Modified-Since when If-None-Match is present</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9430";>KTOR-9430</a> DI: resources are not cleaned up during testing with testApplication</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-7175";>KTOR-7175</a> Ktor-client, connections leak</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9848";>KTOR-9848</a> Android: The Android engine crashes with Unbalanced enter/exit on response read cancellation</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9994";>KTOR-9994</a> Android engine closes RawSourceChannel on the main thread and crashes with NetworkOnMainThreadException</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9959";>KTOR-9959</a> Sockets: CIO writer busy-loops when a nonblocking write returns zero</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9970";>KTOR-9970</a> Java: Cancelling a request before response headers does not abort the HTTP exchange</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-10006";>KTOR-10006</a> OpenAPI: Compiler crash on local variable using object expression</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9972";>KTOR-9972</a> Android: DiskReadViolation when KtorSimpleLogger is initialized during plugin execution</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9985";>KTOR-9985</a> OpenAPI compiler plugin duplicates unrelated schemas (FooDTO -> FooDTO2) after adding new routes</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-2348";>KTOR-2348</a> DoubleReceive: recursive receive pipeline re-entry when receiving content in a receivePipeline interceptor</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9968";>KTOR-9968</a> Test engine streaming responses hang when over 1MB</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9894";>KTOR-9894</a> Netty + Compression: response leaked when the client disconnects before the body is written</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9987";>KTOR-9987</a> WebSockets: Netty sometimes closes socket before sending close frame</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9943";>KTOR-9943</a> HttpStatement.execute can hang when its block abandons a response body</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9980";>KTOR-9980</a> CallLogging: MDC entries leak stale thread-local values when provider returns null</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9790";>KTOR-9790</a> testApplication: <code>sseSession()</code> never returns when the SSE route installs a <code>heartbeat</code></li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9884";>KTOR-9884</a> Directories are returned as empty binaries when using nested jars</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-4245";>KTOR-4245</a> Code snippet in Kdoc for DefaultRequest doesn't compile</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-10035";>KTOR-10035</a> WebSocket drops the queued Close frame when the server session fails</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-10036";>KTOR-10036</a> testApplication: WebSocket client stops reading before the servers Close reply arrives</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/ktorio/ktor/blob/main/CHANGELOG.md";>io.ktor:ktor-network's changelog</a>.</em></p> <blockquote> <h1>3.6.1</h1> <blockquote> <p>Published 29 October 2026</p> </blockquote> <h3>Improvements</h3> <ul> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-10005";>KTOR-10005</a> Native accepted TCP sockets do not enable TCP_NODELAY, unlike JVM</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9966";>KTOR-9966</a> Netty poor performance on delay calls</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-4206";>KTOR-4206</a> The "com.typesafe.config.ConfigException$Missing" exception leaks from the typesafe config library when configuration is merged</li> </ul> <h3>Bugfixes</h3> <ul> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-10037";>KTOR-10037</a> CIO: keep-alive connection hangs when a response fails before writing any bytes</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9969";>KTOR-9969</a> Kotlin/Native CIO server occasionally closes an accepted connection with zero response bytes under CPU load</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9974";>KTOR-9974</a> CIO: close_notify is written concurrently with the last record, corrupting the TLS output and the kotlinx-io segment pool</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9925";>KTOR-9925</a> Resources: Constant sibling route loses to parameterized one when routes are split across separate authenticate blocks</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9938";>KTOR-9938</a> Apache5: streaming response hangs when the block returns before the body arrives</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-10023";>KTOR-10023</a> Ktor 3.6.0 no longer throws BadRequestException for malformed paths</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9986";>KTOR-9986</a> HttpRedirect: a relative Location with dot segments is not normalized, so most engines send <code>..</code> in the request path</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-10085";>KTOR-10085</a> ETags: Ignore If-Modified-Since when If-None-Match is present</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9430";>KTOR-9430</a> DI: resources are not cleaned up during testing with testApplication</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-7175";>KTOR-7175</a> Ktor-client, connections leak</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9848";>KTOR-9848</a> Android: The Android engine crashes with Unbalanced enter/exit on response read cancellation</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9994";>KTOR-9994</a> Android engine closes RawSourceChannel on the main thread and crashes with NetworkOnMainThreadException</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9959";>KTOR-9959</a> Sockets: CIO writer busy-loops when a nonblocking write returns zero</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9970";>KTOR-9970</a> Java: Cancelling a request before response headers does not abort the HTTP exchange</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-10006";>KTOR-10006</a> OpenAPI: Compiler crash on local variable using object expression</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9972";>KTOR-9972</a> Android: DiskReadViolation when KtorSimpleLogger is initialized during plugin execution</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9985";>KTOR-9985</a> OpenAPI compiler plugin duplicates unrelated schemas (FooDTO -> FooDTO2) after adding new routes</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-2348";>KTOR-2348</a> DoubleReceive: recursive receive pipeline re-entry when receiving content in a receivePipeline interceptor</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9968";>KTOR-9968</a> Test engine streaming responses hang when over 1MB</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9894";>KTOR-9894</a> Netty + Compression: response leaked when the client disconnects before the body is written</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9987";>KTOR-9987</a> WebSockets: Netty sometimes closes socket before sending close frame</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9943";>KTOR-9943</a> HttpStatement.execute can hang when its block abandons a response body</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9980";>KTOR-9980</a> CallLogging: MDC entries leak stale thread-local values when provider returns null</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9790";>KTOR-9790</a> testApplication: <code>sseSession()</code> never returns when the SSE route installs a <code>heartbeat</code></li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9884";>KTOR-9884</a> Directories are returned as empty binaries when using nested jars</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-4245";>KTOR-4245</a> Code snippet in Kdoc for DefaultRequest doesn't compile</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-10035";>KTOR-10035</a> WebSocket drops the queued Close frame when the server session fails</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-10036";>KTOR-10036</a> testApplication: WebSocket client stops reading before the servers Close reply arrives</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ktorio/ktor/commit/26cc0037c9f671bbd090633aa2880badb7045855";><code>26cc003</code></a> Release 3.6.1 (<a href="https://redirect.github.com/ktorio/ktor/issues/5970";>#5970</a>)</li> <li><a href="https://github.com/ktorio/ktor/commit/b4fc04d4e1bd0810593519840d8d6c99638caeaa";><code>b4fc04d</code></a> KTOR-10035 Deliver the queued Close frame when the session fails (<a href="https://redirect.github.com/ktorio/ktor/issues/5959";>#5959</a>)</li> <li><a href="https://github.com/ktorio/ktor/commit/fbd2a80a5c8ed719d12f5c4dd11b07f47710a552";><code>fbd2a80</code></a> KTOR-10036 Keep the test host WebSocket client reading until the server close...</li> <li><a href="https://github.com/ktorio/ktor/commit/516fe19e47d1c4432e5217f5392e43147528f3f6";><code>516fe19</code></a> KTOR-10037 Close the CIO connection when a response fails before writing any ...</li> <li><a href="https://github.com/ktorio/ktor/commit/3954d0c5d5ce97c6736a75a48d4d8363b6a9940d";><code>3954d0c</code></a> KTOR-9938: Abort Apache5 exchanges when the response body is cancelled</li> <li><a href="https://github.com/ktorio/ktor/commit/dbc9692489bc2932b85ec4077f6f7afa5c645f8a";><code>dbc9692</code></a> KTOR-9969 Shut down native socket output inside the writer coroutine</li> <li><a href="https://github.com/ktorio/ktor/commit/3ceecd744852a594b8fc6046d69dd257374a95f7";><code>3ceecd7</code></a> KTOR-9992 Fix CIO accept busy loop (<a href="https://redirect.github.com/ktorio/ktor/issues/5961";>#5961</a>)</li> <li><a href="https://github.com/ktorio/ktor/commit/bdfff2b63ec80919d4b93a983e849183164bbe84";><code>bdfff2b</code></a> KTOR-10023 Throw BadRequestException on malformed URL segments</li> <li><a href="https://github.com/ktorio/ktor/commit/737894976a059dcefcc0ad189135fae3afbe3c33";><code>7378949</code></a> KTOR-9986 Remove dot segments from relative redirect targets (<a href="https://redirect.github.com/ktorio/ktor/issues/5939";>#5939</a>)</li> <li><a href="https://github.com/ktorio/ktor/commit/c981394cf73e4f34cbaca3aa487c85012e5a63bd";><code>c981394</code></a> KTOR-9430 Fix test server stopping</li> <li>Additional commits viewable in <a href="https://github.com/ktorio/ktor/compare/3.6.0...3.6.1";>compare view</a></li> </ul> </details> <br /> Updates `org.jetbrains.kotlinx:kotlinx-serialization-json` from 1.11.0 to 1.12.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/Kotlin/kotlinx.serialization/releases";>org.jetbrains.kotlinx:kotlinx-serialization-json's releases</a>.</em></p> <blockquote> <h2>v1.12.0</h2> <blockquote> <p>[!CAUTION] This release contains a breaking behavioral change related to serializer's exception propagation in Json encoder/decoder. The change was rolled back in <a href="https://github.com/Kotlin/kotlinx.serialization/releases/tag/v1.13.0";>1.13.0</a>, please consider updating to 1.13.0 instead.</p> </blockquote> <p>This release is based on Kotlin 2.4.10 and contains all of the changes from <a href="https://github.com/Kotlin/kotlinx.serialization/releases/tag/v1.12.0-RC";>1.12.0-RC</a>.</p> <p>Additionally, it includes a fix removing unnecessary leading whitespaces from Proguard rules (<a href="https://redirect.github.com/Kotlin/kotlinx.serialization/issues/3270";>#3270</a>), and two changes stabilizing <code>kotlin.uuid.Uuid</code> serializer (<a href="https://redirect.github.com/Kotlin/kotlinx.serialization/issues/3263";>#3263</a>) and <code>kotlin.time.Instant</code> serializers (<a href="https://redirect.github.com/Kotlin/kotlinx.serialization/issues/3261";>#3261</a>).</p> <blockquote> <p>For your convenience, the changelog for <a href="https://github.com/Kotlin/kotlinx.serialization/releases/tag/v1.12.0-RC";>1.12.0-RC</a> is duplicated below:</p> </blockquote> <h2>API stabilization and deprecations</h2> <p>A big portion of the Json and Core APIs has been stabilized. Most important ones include: <code>@KeepGeneratedSerializer</code> and <code>@SerialInfo</code> annotations, <code>JsonNamingStrategy</code>, and <code>ContextualSerializer</code>. Additionally, various descriptor builders such as <code>listDescriptor</code> and JsonElementBuilder's <code>addAll</code> functions are also stable and can be freely used. There is also one deprecation: <code>ChunkedDecoder</code> interface. Since there is no demand for it, we plan to remove it in the future. See details in the <a href="https://redirect.github.com/Kotlin/kotlinx.serialization/issues/3238";>#3238</a>, <a href="https://redirect.github.com/Kotlin/kotlinx.serialization/issues/3239";>#3239</a>, and <a href="https://redirect.github.com/Kotlin/kotlinx.serialization/issues/3216";>#3216</a>.</p> <p>Also, <code>kotlin.time.Instant</code> and <code>kotlin.uuid.Uuid</code> serializers are no longer annotated with experimental annotations from the Kotlin standard library (see <a href="https://redirect.github.com/Kotlin/kotlinx.serialization/pull/3261";>#3261</a> and <a href="https://redirect.github.com/Kotlin/kotlinx.serialization/pull/3263";>#3263</a>)</p> <h2>Performance improvements</h2> <p>We also improved performance in various areas. ASCII-specific parser (<a href="https://redirect.github.com/Kotlin/kotlinx.serialization/issues/3225";>#3225</a>) brings performance of decoding from Okio and kotlinx-io sources closer to decoding performance from String. <a href="https://redirect.github.com/Kotlin/kotlinx.serialization/issues/3220";>#3220</a> makes decoding significantly faster in case <code>JsonElement</code> present in your serializable classes. And <a href="https://redirect.github.com/Kotlin/kotlinx.serialization/issues/3248";>#3248</a> should bring overall performance improvements (up to 30%) on large strings.</p> <h2>Exceptions rework</h2> <p>We continue to improve exception handling in Json encoders and decoders. <a href="https://redirect.github.com/Kotlin/kotlinx.serialization/issues/3235";>#3235</a> makes a big change around custom serializers and <code>@Serializable</code> classes constructors: from now on, every exception thrown during deserialization is wrapped by decoder into a <code>JsonException</code>. This way, it is more predictable to write a <code>catch</code> and it is easier to understand what went wrong: <code>JsonDecodingException</code> also includes context information such as Json path and input. Besides that, <a href="https://redirect.github.com/Kotlin/kotlinx.serialization/issues/3246";>#3246</a> limits maximum nesting depth of Json document, so you will get a proper <code>JsonDecodingException</code> instead of a random stack overflow error.</p> <h2>CBOR improvements</h2> <p>CBOR format also gets many improvements in this release. The most important one is memory optimization for definitely-sized collections (<a href="https://redirect.github.com/Kotlin/kotlinx.serialization/issues/3191";>#3191</a>, <a href="https://redirect.github.com/Kotlin/kotlinx.serialization/issues/3192";>#3192</a>).</p> <p>The others include:</p> <ul> <li>Encode unsigned integer types as positive integers (<a href="https://redirect.github.com/Kotlin/kotlinx.serialization/issues/3194";>#3194</a>) (thanks to <a href="https://github.com/eyupcanakman";>Eyüp Can Akman</a>)</li> <li>Correctly decode CborLabel values (<a href="https://redirect.github.com/Kotlin/kotlinx.serialization/issues/3195";>#3195</a>)</li> <li>Include actual tag info into CborDecodingException (<a href="https://redirect.github.com/Kotlin/kotlinx.serialization/issues/3197";>#3197</a>)</li> </ul> <h2>Protobuf improvements</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/Kotlin/kotlinx.serialization/blob/master/CHANGELOG.md";>org.jetbrains.kotlinx:kotlinx-serialization-json's changelog</a>.</em></p> <blockquote> <h1>1.12.0 / 2026-10-19</h1> <p>This release is based on Kotlin 2.4.10 and contains all of the changes from 1.12.0-RC.</p> <p>Additionally, it includes a fix removing unnecessary leading whitespaces from Proguard rules (<a href="https://redirect.github.com/Kotlin/kotlinx.serialization/issues/3270";>#3270</a>), and two changes stabilizing <code>kotlin.uuid.Uuid</code> serializer (<a href="https://redirect.github.com/Kotlin/kotlinx.serialization/issues/3263";>#3263</a>) and <code>kotlin.time.Instant</code> serializers (<a href="https://redirect.github.com/Kotlin/kotlinx.serialization/issues/3261";>#3261</a>).</p> <blockquote> <p>For your convenience, the changelog for 1.12.0-RC is duplicated below:</p> </blockquote> <h2>API stabilization and deprecations</h2> <p>A big portion of the Json and Core APIs has been stabilized. Most important ones include: <code>@KeepGeneratedSerializer</code> and <code>@SerialInfo</code> annotations, <code>JsonNamingStrategy</code>, and <code>ContextualSerializer</code>. Additionally, various descriptor builders such as <code>listDescriptor</code> and JsonElementBuilder's <code>addAll</code> functions are also stable and can be freely used. There is also one deprecation: <code>ChunkedDecoder</code> interface. Since there is no demand for it, we plan to remove it in the future. See details in the <a href="https://redirect.github.com/Kotlin/kotlinx.serialization/issues/3238";>#3238</a>, <a href="https://redirect.github.com/Kotlin/kotlinx.serialization/issues/3239";>#3239</a>, and <a href="https://redirect.github.com/Kotlin/kotlinx.serialization/issues/3216";>#3216</a>.</p> <p>Also, <code>kotlin.time.Instant</code> and <code>kotlin.uuid.Uuid</code> serializers are no longer annotated with experimental annotations from the Kotlin standard library (see [#3261](<a href="https://redirect.github.com/Kotlin/kotlinx.serialization/pull/3261";>Kotlin/kotlinx.serialization#3261</a> and <a href="https://redirect.github.com/Kotlin/kotlinx.serialization/pull/3263";>#3263</a>)</p> <h2>Performance improvements</h2> <p>We also improved performance in various areas. ASCII-specific parser (<a href="https://redirect.github.com/Kotlin/kotlinx.serialization/issues/3225";>#3225</a>) brings performance of decoding from Okio and kotlinx-io sources closer to decoding performance from String. <a href="https://redirect.github.com/Kotlin/kotlinx.serialization/issues/3220";>#3220</a> makes decoding significantly faster in case <code>JsonElement</code> present in your serializable classes. And <a href="https://redirect.github.com/Kotlin/kotlinx.serialization/issues/3248";>#3248</a> should bring overall performance improvements (up to 30%) on large strings.</p> <h2>Exceptions rework</h2> <p>We continue to improve exception handling in Json encoders and decoders. <a href="https://redirect.github.com/Kotlin/kotlinx.serialization/issues/3235";>#3235</a> makes a big change around custom serializers and <code>@Serializable</code> classes constructors: from now on, every exception thrown during deserialization is wrapped by decoder into a <code>JsonException</code>. This way, it is more predictable to write a <code>catch</code> and it is easier to understand what went wrong: <code>JsonDecodingException</code> also includes context information such as Json path and input. Besides that, <a href="https://redirect.github.com/Kotlin/kotlinx.serialization/issues/3246";>#3246</a> limits maximum nesting depth of Json document, so you will get a proper <code>JsonDecodingException</code> instead of a random stack overflow error.</p> <h2>CBOR improvements</h2> <p>CBOR format also gets many improvements in this release. The most important one is memory optimization for definitely-sized collections (<a href="https://redirect.github.com/Kotlin/kotlinx.serialization/issues/3191";>#3191</a>, <a href="https://redirect.github.com/Kotlin/kotlinx.serialization/issues/3192";>#3192</a>).</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/Kotlin/kotlinx.serialization/commit/4c28c3e33c145da536f1f4a671f70e5eb5b62b9c";><code>4c28c3e</code></a> 1.12.0 release (<a href="https://redirect.github.com/Kotlin/kotlinx.serialization/issues/3295";>#3295</a>)</li> <li><a href="https://github.com/Kotlin/kotlinx.serialization/commit/abe8a9672755a65ba896904b2a259936e950e60f";><code>abe8a96</code></a> Merge remote-tracking branch 'origin/master' into dev</li> <li><a href="https://github.com/Kotlin/kotlinx.serialization/commit/952d17a0c90459dbf2ca59d1127d814a925c5dd8";><code>952d17a</code></a> Added Gradle task to prepare release (<a href="https://redirect.github.com/Kotlin/kotlinx.serialization/issues/3279";>#3279</a>)</li> <li><a href="https://github.com/Kotlin/kotlinx.serialization/commit/6f30025b6202219a363018d39ae7916ec63973f8";><code>6f30025</code></a> Remove Play verification files (<a href="https://redirect.github.com/Kotlin/kotlinx.serialization/issues/3266";>#3266</a>)</li> <li><a href="https://github.com/Kotlin/kotlinx.serialization/commit/89b23caaf9407a213528511fadb1dde874ff61f2";><code>89b23ca</code></a> Workaround watchosArm32 removal (<a href="https://redirect.github.com/Kotlin/kotlinx.serialization/issues/3291";>#3291</a>)</li> <li><a href="https://github.com/Kotlin/kotlinx.serialization/commit/53932a089bd3b772cbaf7a61a501f9c3e9124e3d";><code>53932a0</code></a> Update links to Okio site and its docs (<a href="https://redirect.github.com/Kotlin/kotlinx.serialization/issues/3292";>#3292</a>)</li> <li><a href="https://github.com/Kotlin/kotlinx.serialization/commit/3a5db3bc916fd3b0f70f932c23cd543a61840956";><code>3a5db3b</code></a> Reduce the number of input fields for bug report</li> <li><a href="https://github.com/Kotlin/kotlinx.serialization/commit/9ede0e27c8e7403bfdec16cd3c34a0c8b8742715";><code>9ede0e2</code></a> Added templates to the issue creation wizard</li> <li><a href="https://github.com/Kotlin/kotlinx.serialization/commit/5d3f884ace117bc940756dd8a52c6d3daa7e86c8";><code>5d3f884</code></a> Update Dokka to version 2.3.0-Beta (<a href="https://redirect.github.com/Kotlin/kotlinx.serialization/issues/3286";>#3286</a>)</li> <li><a href="https://github.com/Kotlin/kotlinx.serialization/commit/1fe9a49ed0230a1e17a5d1c817b069280405ef20";><code>1fe9a49</code></a> Suppress deprecation of nodejs in wasmWasi configuration (<a href="https://redirect.github.com/Kotlin/kotlinx.serialization/issues/3287";>#3287</a>)</li> <li>Additional commits viewable in <a href="https://github.com/Kotlin/kotlinx.serialization/compare/v1.11.0...v1.12.0";>compare view</a></li> </ul> </details> <br /> Updates `com.squareup.okhttp3:mockwebserver` from 4.12.0 to 4.12.1 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/lysine-dev/okhttp/commit/f5dc9a0f3a268315f9776e07507f7f97459bb9d3";><code>f5dc9a0</code></a> Prepare for release 4.12.1.</li> <li><a href="https://github.com/lysine-dev/okhttp/commit/e4c28adfcfa0543a31c08b9e4e713b109d9cbde6";><code>e4c28ad</code></a> OkHttp 4.12.x: Blocklist 8 certificates for CVE-2026-111943 (<a href="https://redirect.github.com/square/okhttp/issues/9806";>#9806</a>)</li> <li>See full diff in <a href="https://github.com/square/okhttp/compare/parent-4.12.0...parent-4.12.1";>compare view</a></li> </ul> </details> <br /> Updates `plugin.serialization` from 2.4.20 to 2.4.21 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/JetBrains/kotlin/releases";>plugin.serialization's releases</a>.</em></p> <blockquote> <h2>Kotlin 2.4.21</h2> <h2>Changelog</h2> <h3>Backend. Wasm</h3> <ul> <li><a href="https://youtrack.jetbrains.com/issue/KT-89267";><code>KT-89267</code></a> K/Wasm: calling a (T) -> R lambda with an argument that isn't a T traps instead of throwing ClassCastException</li> </ul> <h3>JVM. Reflection</h3> <ul> <li><a href="https://youtrack.jetbrains.com/issue/KT-89280";><code>KT-89280</code></a> NoSuchElementException in argumentsMakeSenseOnlyForMutableContainer for Java non-static inner class of generic outer class</li> <li><a href="https://youtrack.jetbrains.com/issue/KT-80710";><code>KT-80710</code></a> Reflection: change KCallable representation to avoid dependency on K1</li> </ul> <h3>JavaScript</h3> <ul> <li><a href="https://youtrack.jetbrains.com/issue/KT-89449";><code>KT-89449</code></a> Kotlin/JS: Member names no longer minified in production</li> <li><a href="https://youtrack.jetbrains.com/issue/KT-89363";><code>KT-89363</code></a> KJS. Regular class with companion can't extend external class</li> </ul> <h3>Tools. Compiler plugins. Serialization</h3> <ul> <li><a href="https://youtrack.jetbrains.com/issue/KT-89275";><code>KT-89275</code></a> Kotlin/Wasm: Invalid Wasm is emitted for a <code>@Serializable</code> generic class with a class upper bound</li> </ul> <h3>Tools. Gradle. Native</h3> <ul> <li><a href="https://youtrack.jetbrains.com/issue/KT-89285";><code>KT-89285</code></a> SwiftPM import results in flooded log</li> <li><a href="https://youtrack.jetbrains.com/issue/KT-86251";><code>KT-86251</code></a> K/N: Flaky linkDebugTestLinuxX64 failure with "truncated or malformed archive" on libstdlib-cache.a</li> </ul> <h3>Tools. Scripts</h3> <ul> <li><a href="https://youtrack.jetbrains.com/issue/KT-89247";><code>KT-89247</code></a> Kotlin Script: NoClassDefFoundError on 2nd execution with transitive dependency from imported script</li> <li><a href="https://youtrack.jetbrains.com/issue/KT-89220";><code>KT-89220</code></a> JSR-223: generic Java bindings break all subsequent <code>eval()</code> calls</li> <li><a href="https://youtrack.jetbrains.com/issue/KT-88458";><code>KT-88458</code></a> Audit closeable resource usage</li> <li><a href="https://youtrack.jetbrains.com/issue/KT-88453";><code>KT-88453</code></a> <code>VirtualFileScriptSource.text</code> leaks an unclosed file stream — script source file handle held until GC, blocks file deletion on Windows</li> </ul> <h2>Kotlin 2.4.21-RC</h2> <h2>Changelog</h2> <h3>Backend. Wasm</h3> <ul> <li><a href="https://youtrack.jetbrains.com/issue/KT-89267";><code>KT-89267</code></a> K/Wasm: calling a (T) -> R lambda with an argument that isn't a T traps instead of throwing ClassCastException</li> </ul> <h3>JVM. Reflection</h3> <ul> <li><a href="https://youtrack.jetbrains.com/issue/KT-89280";><code>KT-89280</code></a> NoSuchElementException in argumentsMakeSenseOnlyForMutableContainer for Java non-static inner class of generic outer class</li> <li><a href="https://youtrack.jetbrains.com/issue/KT-80710";><code>KT-80710</code></a> Reflection: change KCallable representation to avoid dependency on K1</li> </ul> <h3>JavaScript</h3> <ul> <li><a href="https://youtrack.jetbrains.com/issue/KT-89449";><code>KT-89449</code></a> Kotlin/JS: Member names no longer minified in production</li> <li><a href="https://youtrack.jetbrains.com/issue/KT-89363";><code>KT-89363</code></a> KJS. Regular class with companion can't extend external class</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/JetBrains/kotlin/blob/master/ChangeLog.md";>plugin.serialization's changelog</a>.</em></p> <blockquote> <h2>2.4.21</h2> <h3>Backend. Wasm</h3> <ul> <li><a href="https://youtrack.jetbrains.com/issue/KT-89267";><code>KT-89267</code></a> K/Wasm: calling a (T) -> R lambda with an argument that isn't a T traps instead of throwing ClassCastException</li> </ul> <h3>JVM. Reflection</h3> <ul> <li><a href="https://youtrack.jetbrains.com/issue/KT-89280";><code>KT-89280</code></a> NoSuchElementException in argumentsMakeSenseOnlyForMutableContainer for Java non-static inner class of generic outer class</li> <li><a href="https://youtrack.jetbrains.com/issue/KT-80710";><code>KT-80710</code></a> Reflection: change KCallable representation to avoid dependency on K1</li> </ul> <h3>JavaScript</h3> <ul> <li><a href="https://youtrack.jetbrains.com/issue/KT-89449";><code>KT-89449</code></a> Kotlin/JS: Member names no longer minified in production</li> <li><a href="https://youtrack.jetbrains.com/issue/KT-89363";><code>KT-89363</code></a> KJS. Regular class with companion can't extend external class</li> </ul> <h3>Tools. Compiler plugins. Serialization</h3> <ul> <li><a href="https://youtrack.jetbrains.com/issue/KT-89275";><code>KT-89275</code></a> Kotlin/Wasm: Invalid Wasm is emitted for a <code>@Serializable</code> generic class with a class upper bound</li> </ul> <h3>Tools. Gradle. Native</h3> <ul> <li><a href="https://youtrack.jetbrains.com/issue/KT-89285";><code>KT-89285</code></a> SwiftPM import results in flooded log</li> <li><a href="https://youtrack.jetbrains.com/issue/KT-86251";><code>KT-86251</code></a> K/N: Flaky linkDebugTestLinuxX64 failure with "truncated or malformed archive" on libstdlib-cache.a</li> </ul> <h3>Tools. Scripts</h3> <ul> <li><a href="https://youtrack.jetbrains.com/issue/KT-89247";><code>KT-89247</code></a> Kotlin Script: NoClassDefFoundError on 2nd execution with transitive dependency from imported script</li> <li><a href="https://youtrack.jetbrains.com/issue/KT-89220";><code>KT-89220</code></a> JSR-223: generic Java bindings break all subsequent <code>eval()</code> calls</li> <li><a href="https://youtrack.jetbrains.com/issue/KT-88458";><code>KT-88458</code></a> Audit closeable resource usage</li> <li><a href="https://youtrack.jetbrains.com/issue/KT-88453";><code>KT-88453</code></a> <code>VirtualFileScriptSource.text</code> leaks an unclosed file stream — script source file handle held until GC, blocks file deletion on Windows</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/JetBrains/kotlin/commit/9180ce6a7a7d3627f88b424717583f28ddca052d";><code>9180ce6</code></a> Add changelog for 2.4.21-RC</li> <li><a href="https://github.com/JetBrains/kotlin/commit/851077bb6eae00e74b209953ece77f42e1212097";><code>851077b</code></a> [Serialization] Copy type parameter bounds onto generated serializers (<a href="https://redirect.github.com/JetBrains/kotlin/issues/8421";>#8421</a>)</li> <li><a href="https://github.com/JetBrains/kotlin/commit/1b6b624fff071d33cfd5af06c6f541507f748560";><code>1b6b624</code></a> [Wasm]: Generate a Kotlin-level cast for bridged lambda functions. (<a href="https://redirect.github.com/JetBrains/kotlin/issues/8404";>#8404</a>)</li> <li><a href="https://github.com/JetBrains/kotlin/commit/3c223c27ab7b217286a752a601e5ba1c97383def";><code>3c223c2</code></a> Rrr/2.4.20/core docs (<a href="https://redirect.github.com/JetBrains/kotlin/issues/8322";>#8322</a>)</li> <li><a href="https://github.com/JetBrains/kotlin/commit/c681c2e5b0fb6558a692424d45fe054f7fb30dc4";><code>c681c2e</code></a> [2.4.20] [KT-89285] Stop the xcodebuild logs being output by default (<a href="https://redirect.github.com/JetBrains/kotlin/issues/8277";>#8277</a>)</li> <li><a href="https://github.com/JetBrains/kotlin/commit/f0645d1902ae16b1e62bc86a9908692c5ecdcb01";><code>f0645d1</code></a> [2.4.20] [JS] Reorder <code>CompilerConfiguration</code> properties initialization (<a href="https://redirect.github.com/JetBrains/kotlin/issues/8282";>#8282</a>)</li> <li><a href="https://github.com/JetBrains/kotlin/commit/f507ecde241e2fc56bc17758f4e11ee1ad4994d6";><code>f507ecd</code></a> [JS] Don't try to initialize an external class's companion object</li> <li><a href="https://github.com/JetBrains/kotlin/commit/c60d7d8622bfe184e1e6c648e3b7297432c9b369";><code>c60d7d8</code></a> Reflection: fix NoSuchElementException in ConvertFromJava.kt</li> <li><a href="https://github.com/JetBrains/kotlin/commit/05d1cdee72c398e1549bd3a9a2983a7da03b6bd0";><code>05d1cde</code></a> REPL: render correct reflected binding type</li> <li><a href="https://github.com/JetBrains/kotlin/commit/5acec47d93759687b8f3d5090ff29aab9ab1b643";><code>5acec47</code></a> Scripting: store collected dependencies recursively</li> <li>Additional commits viewable in <a href="https://github.com/JetBrains/kotlin/compare/v2.4.20...v2.4.21";>compare view</a></li> </ul> </details> <br /> Updates `org.jetbrains.kotlin:kotlin-gradle-plugin` from 2.4.20 to 2.4.21 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/JetBrains/kotlin/releases";>org.jetbrains.kotlin:kotlin-gradle-plugin's releases</a>.</em></p> <blockquote> <h2>Kotlin 2.4.21</h2> <h2>Changelog</h2> <h3>Backend. Wasm</h3> <ul> <li><a href="https://youtrack.jetbrains.com/issue/KT-89267";><code>KT-89267</code></a> K/Wasm: calling a (T) -> R lambda with an argument that isn't a T traps instead of throwing ClassCastException</li> </ul> <h3>JVM. Reflection</h3> <ul> <li><a href="https://youtrack.jetbrains.com/issue/KT-89280";><code>KT-89280</code></a> NoSuchElementException in argumentsMakeSenseOnlyForMutableContainer for Java non-static inner class of generic outer class</li> <li><a href="https://youtrack.jetbrains.com/issue/KT-80710";><code>KT-80710</code></a> Reflection: change KCallable representation to avoid dependency on K1</li> </ul> <h3>JavaScript</h3> <ul> <li><a href="https://youtrack.jetbrains.com/issue/KT-89449";><code>KT-89449</code></a> Kotlin/JS: Member names no longer minified in production</li> <li><a href="https://youtrack.jetbrains.com/issue/KT-89363";><code>KT-89363</code></a> KJS. Regular class with companion can't extend external class</li> </ul> <h3>Tools. Compiler plugins. Serialization</h3> <ul> <li><a href="https://youtrack.jetbrains.com/issue/KT-89275";><code>KT-89275</code></a> Kotlin/Wasm: Invalid Wasm is emitted for a <code>@Serializable</code> generic class with a class upper bound</li> </ul> <h3>Tools. Gradle. Native</h3> <ul> <li><a href="https://youtrack.jetbrains.com/issue/KT-89285";><code>KT-89285</code></a> SwiftPM import results in flooded log</li> <li><a href="https://youtrack.jetbrains.com/issue/KT-86251";><code>KT-86251</code></a> K/N: Flaky linkDebugTestLinuxX64 failure with "truncated or malformed archive" on libstdlib-cache.a</li> </ul> <h3>Tools. Scripts</h3> <ul> <li><a href="https://youtrack.jetbrains.com/issue/KT-89247";><code>KT-89247</code></a> Kotlin Script: NoClassDefFoundError on 2nd execution with transitive dependency from imported script</li> <li><a href="https://youtrack.jetbrains.com/issue/KT-89220";><code>KT-89220</code></a> JSR-223: generic Java bindings break all subsequent <code>eval()</code> calls</li> <li><a href="https://youtrack.jetbrains.com/issue/KT-88458";><code>KT-88458</code></a> Audit closeable resource usage</li> <li><a href="https://youtrack.jetbrains.com/issue/KT-88453";><code>KT-88453</code></a> <code>VirtualFileScriptSource.text</code> leaks an unclosed file stream — script source file handle held until GC, blocks file deletion on Windows</li> </ul> <h2>Kotlin 2.4.21-RC</h2> <h2>Changelog</h2> <h3>Backend. Wasm</h3> <ul> <li><a href="https://youtrack.jetbrains.com/issue/KT-89267";><code>KT-89267</code></a> K/Wasm: calling a (T) -> R lambda with an argument that isn't a T traps instead of throwing ClassCastException</li> </ul> <h3>JVM. Reflection</h3> <ul> <li><a href="https://youtrack.jetbrains.com/issue/KT-89280";><code>KT-89280</code></a> NoSuchElementException in argumentsMakeSenseOnlyForMutableContainer for Java non-static inner class of generic outer class</li> <li><a href="https://youtrack.jetbrains.com/issue/KT-80710";><code>KT-80710</code></a> Reflection: change KCallable representation to avoid dependency on K1</li> </ul> <h3>JavaScript</h3> <ul> <li><a href="https://youtrack.jetbrains.com/issue/KT-89449";><code>KT-89449</code></a> Kotlin/JS: Member names no longer minified in production</li> <li><a href="https://youtrack.jetbrains.com/issue/KT-89363";><code>KT-89363</code></a> KJS. Regular class with companion can't extend external class</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/JetBrains/kotlin/blob/master/ChangeLog.md";>org.jetbrains.kotlin:kotlin-gradle-plugin's changelog</a>.</em></p> <blockquote> <h2>2.4.21</h2> <h3>Backend. Wasm</h3> <ul> <li><a href="https://youtrack.jetbrains.com/issue/KT-89267";><code>KT-89267</code></a> K/Wasm: calling a (T) -> R lambda with an argument that isn't a T traps instead of throwing ClassCastException</li> </ul> <h3>JVM. Reflection</h3> <ul> <li><a href="https://youtrack.jetbrains.com/issue/KT-89280";><code>KT-89280</code></a> NoSuchElementException in argumentsMakeSenseOnlyForMutableContainer for Java non-static inner class of generic outer class</li> <li><a href="https://youtrack.jetbrains.com/issue/KT-80710";><code>KT-80710</code></a> Reflection: change KCallable representation to avoid dependency on K1</li> </ul> <h3>JavaScript</h3> <ul> <li><a href="https://youtrack.jetbrains.com/issue/KT-89449";><code>KT-89449</code></a> Kotlin/JS: Member names no longer minified in production</li> <li><a href="https://youtrack.jetbrains.com/issue/KT-89363";><code>KT-89363</code></a> KJS. Regular class with companion can't extend external class</li> </ul> <h3>Tools. Compiler plugins. Serialization</h3> <ul> <li><a href="https://youtrack.jetbrains.com/issue/KT-89275";><code>KT-89275</code></a> Kotlin/Wasm: Invalid Wasm is emitted for a <code>@Serializable</code> generic class with a class upper bound</li> </ul> <h3>Tools. Gradle. Native</h3> <ul> <li><a href="https://youtrack.jetbrains.com/issue/KT-89285";><code>KT-89285</code></a> SwiftPM import results in flooded log</li> <li><a href="https://youtrack.jetbrains.com/issue/KT-86251";><code>KT-86251</code></a> K/N: Flaky linkD... _Description has been truncated_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
