Skip to content

fix(deps): update minor and patch dependencies - #57

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/minor-and-patch-dependencies
Open

renovate[bot] wants to merge 1 commit into
mainfrom
renovate/minor-and-patch-dependencies

Conversation

@renovate

@renovate renovate Bot commented Sep 14, 2026

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change Age Confidence
bellsoft/liberica-runtime-container stage patch jdk-21-crac-slim-glibcjdk-21.0.12_11-crac-slim-glibc age confidence
gradle (source) minor 9.5.19.7.1 age confidence
gradle (source) stage minor 9.5.1-jdk21-alpine9.7.1-jdk21-alpine age confidence
io.fabric8:kubernetes-client-bom dependencies minor 7.7.07.9.0 age confidence
org.springdoc:springdoc-openapi-starter-webmvc-ui (source) dependencies minor 3.0.33.1.1 age confidence
org.jetbrains.kotlin.plugin.spring plugin minor 2.3.212.4.20 age confidence
org.jetbrains.kotlin.jvm (source) plugin minor 2.3.212.4.20 age confidence

Release Notes

gradle/gradle (gradle)

v9.7.1

Compare Source

v9.7.0

Compare Source

v9.6.1

Compare Source

v9.6.0

Compare Source

fabric8io/kubernetes-client (io.fabric8:kubernetes-client-bom)

v7.9.0

Bugs
  • Fix #​8024: (httpclient-vertx-5) WebSocket operations (exec/attach/portForward/WebSocket-backed watches) on a derived client - one produced by calling newBuilder()/build() on an already-built HttpClient - no longer fall back to Vert.x's bare WebSocketClient defaults. Vertx5HttpClientBuilder.build()'s short-circuit path for derived clients reused the original client's plain HTTP connection (with its configuration intact) but always created a brand-new WebSocketClient with no options at all, discarding both the trust/key material (so TLS verified against the JVM default trust store instead of the configured cluster CA) and the configured limits (maxFrameSize/maxMessageSize fell back to 64 KiB/256 KiB instead of unlimited, and maxConnections to 50 instead of 8192, so oversized exec/attach messages were silently dropped even on plain HTTP). This affects kubernetes-httpclient-vertx-5 only, which is opt-in - the bundled default kubernetes-httpclient-vertx (Vert.x 4) serves WebSockets from the same client it reuses when deriving and was never affected - and it is present in 7.6.0 through 7.8.0. Derivation happens more often than it looks: OpenShiftClientImpl derives on every adapt(OpenShiftClient.class) to install its OAuth token-refresh interceptor, OpenShiftOAuthInterceptor derives on every token refresh, and BaseClient#newClient derives whenever a differing RequestConfig is set. Derived clients now reuse the original's WebSocketClient outright, the same way they already reused its HTTP client, so they can no longer drift from it and no second transport is allocated per derivation. Note that sharing the transport also means closing any client in a derived family closes it for the whole family: close() on a client obtained from adapt(OpenShiftClient.class) now ends WebSocket operations on the client it was derived from as well, which is already what happened to that client's HTTP requests and what the other four implementations do. Nothing usable is lost, since the original's HTTP client was closed regardless; what changes is that the per-derivation WebSocketClient is no longer left behind unclosed
  • Fix #​8029: (httpclient-vertx-5, httpclient-jetty) WebSocket connections now honor the configured proxy, so exec/attach/portForward and WebSocket-backed watches no longer connect straight to the API server and bypass a mandated egress proxy. Both implementations serve WebSockets from a transport separate from the HTTP client (a Vert.x 5 WebSocketClient, and a second Jetty HttpClient behind the WebSocketClient) and neither was given the proxy configuration; Jetty's WebSocket transport now also receives the proxy BasicAuthentication entry. The OkHttp, JDK and Vert.x 4 modules were unaffected because a single client serves both. On httpclient-vertx-5 the configured connect timeout was not applied to the WebSocket client either, so a WebSocket connect could hang well past it. One consequence worth calling out: when the proxy credentials cannot be decoded - HttpClientUtils.decodeBasicCredentials returns null for anything that is not Basic, or whose decoded value does not split into exactly two :-separated parts, so a proxy password containing a colon is enough - the client falls back to stamping Proxy-Authorization on the request instead of configuring it on the transport. Such WebSocket connections now reach the proxy and are rejected with a 407 rather than silently completing straight to the API server, so a setup that appeared to work only because it was bypassing the proxy will now fail
  • Fix #​7807: (kube-api-test) The KUBE_API_TEST_STARTUP_TIMEOUT environment variable is now parsed instead of throwing ClassCastException on every use — the value (always a String) was passed to Class.cast() for an Integer/Boolean target, which only widens reference types and never parses, so the timeout could not be configured via environment at all. A new startupTimeout attribute on @EnableKubeAPIServer (e.g. @EnableKubeAPIServer(startupTimeout = 180000)) allows overriding it declaratively, and all three configuration paths (annotation, builder, env var) now reject non-positive values
  • Fix #​7983: (mockwebserver) WebSocket upgrades are now performed synchronously from the Vert.x request handler instead of from the asynchronous HttpServerRequest#body() callback. Deferring the upgrade let the request end event be processed first, so HttpServerRequest#toWebSocket() intermittently threw IllegalStateException: Request has already been read and the upgrade was lost (surfacing as flaky exec/attach mock-server tests). Upgrade requests carry no body, so they are detected via the Upgrade header and upgraded before the request is read; the asynchronous path is unchanged for regular HTTP requests
  • Fix #​7955: (java-generator) Malicious CRD schema values can no longer inject executable code into the generated Java sources. Schema-controlled values (enum values, CRD group/version/names, property names, descriptions and defaults) are emitted as fully escaped Java string literals, so a value carrying a Unicode-escaped quote cannot break out of its literal once javac decodes it. As a defense in depth, each generated class is also re-parsed and structurally validated before it is written (with Java Unicode escape preprocessing enabled to match javac), aborting generation on any residual structural mismatch
  • Fix #​8028: (openshift-model, kube-api-test) No package is shipped by two artifacts anymore, so each pair can be placed on the JPMS module path together. openshift-model no longer bundles the io.fabric8.openshift.api.model.config.* classes that openshift-model-config owns (its Export-Package wildcard inlined them from that dependency); they still reach consumers through it. Fabric8ClientInjectionHandler moved to io.fabric8.kubeapitest.junit.inject
Improvements
Dependency Upgrade
  • Fix #​8033: bump gateway-api from 1.5.1 to 1.6.1
New Features
  • Fix #​7752: Support for Kubernetes v1.37.0 (Garhwal)
  • Fix #​8033: gateway-api model gains v1.TCPRoute and v1.UDPRoute (both graduated from v1alpha2 upstream in gateway-api v1.6.0). The v1alpha2 types remain available, but upstream has deprecated them and will remove them in a future release, so new code should use the v1 types
Note: Breaking changes
  • Fix #​7752: Kubernetes model API removals (removed upstream in Kubernetes v1.37.0). The following API versions have been completely removed from Kubernetes and are no longer available in the client:
    • certificates.k8s.io/v1alpha1/ClusterTrustBundle → use certificates.k8s.io/v1 or v1beta1
    • networking.k8s.io/v1beta1/IPAddress → use networking.k8s.io/v1
    • networking.k8s.io/v1beta1/ServiceCIDR → use networking.k8s.io/v1
    • storage.k8s.io/v1beta1/VolumeAttributesClass → use storage.k8s.io/v1
    • scheduling.k8s.io/v1alpha2 (entire API version, 28 types) → use v1alpha3 or v1beta1
  • Fix #​7752: VolumeMount constructor signature changed (Kubernetes v1.37.0 added bindMountOptions field). The canonical constructor now takes bindMountOptions (List) as its first parameter. Builder usage (new VolumeMountBuilder().with...()) is unaffected
  • Fix #​8033: gateway-api model v1.SessionPersistence no longer exposes idleTimeout (removed upstream in gateway-api v1.6.0). Besides the field, this removes getIdleTimeout()/setIdleTimeout(), collapses the canonical constructor from five arguments to four, and drops SessionPersistenceFluent.withIdleTimeout()/getIdleTimeout()/hasIdleTimeout(), so the builder form (withNewSessionPersistence().withIdleTimeout(...)) no longer compiles. There is no runtime data loss: the class keeps its @JsonAnyGetter/@JsonAnySetter, and both the fluent and the builder carry additionalProperties through, so JSON or YAML still containing idleTimeout continues to deserialize and re-serialize intact
  • Fix #​8028: (kube-api-test) Fabric8ClientInjectionHandler moved to io.fabric8.kubeapitest.junit.inject. It is resolved through ServiceLoader, so only code naming the class directly is affected
  • Fix #​8028: (openshift-model) The bundle no longer exports or contains io.fabric8.openshift.api.model.config.*. Maven consumers are unaffected (openshift-model-config is a compile dependency), but OSGi deployments importing those packages must install the openshift-model-config bundle, which the openshift-client Karaf feature already does

v7.8.0

Bugs
  • Fix #​7953: (httpclient-jdk) bodyless requests now preserve the requested HTTP method instead of silently defaulting to GET. JdkHttpClientImpl.requestBuilder only called HttpRequest.Builder.method(...) inside the body != null branch, so a bodyless DELETE/POST/PUT/PATCH (such as client.raw(uri, "DELETE", null)) was sent as GET on the JDK backend; the method is now set with BodyPublishers.noBody() when there is no body, matching the OkHttp, Jetty and Vert.x backends
  • Fix #​7435: (kubernetes-client) A SharedIndexInformer's periodic resync no longer stops permanently and silently when a single resync cycle throws. DefaultSharedIndexInformer.scheduleResync runs the resync through Utils.scheduleAtFixedRate, whose self-rescheduling chain re-arms the next cycle only when the previous one completes normally; an uncaught exception completed the (unobserved) resyncFuture exceptionally and the resync was never scheduled again, with no log, while the independent watch kept isWatching() reporting true (a restart was required to recover). The resync command now catches and WARN-logs the failure so the schedule fires again at the next interval
  • Fix #​7933: (kubernetes-client-api) Deterministic TLS trust failures (untrusted cert, expired cert, hostname mismatch) are now classified as terminal and fail fast instead of being retried by the shared StandardHttpClient.shouldRetry backoff loop (~19 s drain). The classifier walks both getCause() and getSuppressed() trees for CertificateException, CertPathValidatorException, CertPathBuilderException, and SSLPeerUnverifiedException. Affects all five HTTP client modules (jdk, jetty, okhttp, vertx-4, vertx-5) on both the HTTP request and WebSocket connect paths
  • Fix #​7867: (kubernetes-server-mock) WatchEventsListener now buffers outgoing watch events that are scheduled before Vert.x fires onOpen and replays them once the WebSocket is available, closing the open-side race where a CRUD operation landing between handleWatch registering the listener and onOpen populating webSocketRef scheduled a send that dereferenced a null webSocketRef; the resulting NullPointerException was silently swallowed by the executor and the event was dropped. Buffered events are replayed after the initial-sync ADDEDs so ordering is preserved
  • Fix #​7896: (kubernetes-client) AbstractWatchManager.watchEnded() now emits a WatcherException when a watch closes cleanly with no messages within 2 seconds, compensating for a GKE-specific behaviour on v1/events where the GKFE proxy rejects a stale resourceVersion with a bare WebSocket close (code 1000, no body) instead of {"type":"ERROR","code":410}, causing an indefinite reconnect loop with the same stale resourceVersion
  • Fix #​7907: (httpclient-vertx-5) WebSocket-over-TLS operations (exec/attach/portForward/WebSocket-backed watches, and the CRD-establishment waits that depend on them) now trust the cluster certificate again. Vert.x 5.1 rewrote the WebSocket client to resolve TLS through a per-connection ClientSSLOptions that ignored the custom SslContextFactory the client used as its sole carrier of trust material, so WebSocket handshakes silently fell back to the default JVM trust store, failed PKIX validation, and hung to the client-side timeout (regular HTTPS request/response was unaffected). Both the HTTP and WebSocket clients are now configured uniformly with Vert.x TrustOptions/KeyCertOptions derived from the supplied trust/key managers
  • Fix #​7873: (kube-api-test) Utils.findFreePort now records every port it hands out for the JVM's lifetime and skips any port already returned, eliminating the back-to-back duplicate-port window that surfaced as a JUnitExtensionOnMethodTest.simpleTest2 flake — the probe ServerSocket was closed before the caller bound it, so EtcdProcess.startEtcd() and KubeAPIServerProcess.startApiServer() could draw the same port from Random.nextInt, etcd would win the bind, and apiserver would exit 1 with bind: address already in use, surfacing in ProcessReadinessChecker as Connection reset by peer
  • Fix #​7857: (kubernetes-server-mock) WatchEventsListener.onClosing now queues the server-side WebSocket.close(...) on the listener's send executor instead of invoking it directly on the Vert.x event loop. This preserves FIFO ordering with any data frames already queued on that executor, so events scheduled before a client-initiated watch close (e.g. an ADDED/DELETED pair on a final create/delete before watch.close()) are delivered before the close frame instead of being silently dropped by writes against an already-closing socket
  • Fix #​7832: (sonar) Re-interrupt thread in 8 production-code catch blocks that swallowed InterruptedException without preserving the interrupt status (S2142)
  • Fix #​7841: (mockwebserver) split Dispatcher shutdown into two phases so MockDispatcher only tears down per-session WebSocketSession executors after the HTTP server has drained, removing the window where an in-flight upgrade's onOpen could land on a shut-down executor. shutdown() still runs before httpServer.close() to unblock blocked dispatches (e.g. QueueDispatcher.take()); the new releaseResources() runs after. WebSocketSession.send() additionally catches RejectedExecutionException defensively so any residual shutdown race stays silent instead of bubbling as a Vert.x Unhandled exception. KubernetesMixedDispatcher now delegates both lifecycle hooks to its inner MockDispatcher, fixing a pre-existing leak where CRUD-mode WebSocket session executors were never shut down
  • Fix #​7779: (kubernetes-client) ExecWebSocketListener now notifies the user-supplied ExecListener on transport-level errors that race with terminateOnError / channel-3 exit-status completion — listener.onFailure (or onClose) fires exactly once, gated by a dedicated flag, instead of being silently swallowed when the deferred onError task observes exitCode.isDone()
  • Fix #​7765: (kubernetes-client) BaseOperation.informOnCondition now stops the informer inline when the inner predicate completes the future, closing a CompletableFuture postComplete race where a waiter helping drain dependents could fire informer.stop after cf.complete had already triggered a spurious ?watch=true HTTP request
  • Fix #​7847: (kubernetes-client) BaseClient.addToCloseable now synchronizes on the internal closeable set rather than the caller-supplied parameter, so callers cannot break mutual exclusion by passing different references (sonar S2445)
  • Fix #​7847: (kubernetes-client-api) KUBERNETES_SUBDOMAIN_REGEX uses possessive quantifiers on the outer groups to block ReDoS-style backtracking on adversarial subdomain input; semantics still match the canonical RFC 1123 subdomain pattern (sonar S5998)
  • Fix #​7847: (kubernetes-client-api) Serialization.yamlMapper builds the mapper into a local before assigning to the volatile field, so concurrent readers can no longer observe a partially-initialized instance with modules not yet registered (sonar S3064)
  • Fix #​7847: (mockwebserver) self-signed cert/key temp file cleanup goes through Files.deleteIfExists with logging instead of swallowing the File.delete() return value (sonar S899)
  • Fix #​7847: (httpclient-okhttp) OkHttpClientBuilderImpl now picks the first X509TrustManager from a multi-entry TrustManager[] rather than passing null to OkHttp's sslSocketFactory and NPE'ing; user-supplied sslContext is preserved for multi-CA setups (sonar S2637)
  • Fix #​7847: (httpclient-okhttp) OkHttpClientImpl.doClose removes dead null checks on dispatcher and connectionPool that are guaranteed non-null by the OkHttp API (sonar S2583)
Improvements
  • Fix #​7675: (mockwebserver) MockWebServer.dispatcher field marked volatile so a setDispatcher(...) call is reliably visible to the Vert.x request handler thread without further synchronization. MockWebServer.reset() Javadoc tightened to make its non-destructive contract explicit (no change to the running server, dispatcher, listeners, SSL/TLS state, port, or protocols)
  • Fix #​7809: (kubernetes-client) Support for shard selectors for list and watch - including informers
  • Fix #​7837: (kubernetes-client) Follow-ups on shard selector
  • Fix #​7899: (kubernetes-client) Callback before re-list for Informers
Dependency Upgrade
  • Fix #​7849: bump istio.io/client-go from 1.29.2 to 1.30.0
  • Fix #​7894: bump k8s.io/autoscaler/vertical-pod-autoscaler from 1.6.0 to 1.7.0
  • Fix #​7894: bump k8s.io/gengo/v2 from 2.0.0-20251215205346-5ee0d033ba5b to 2.0.0-20260408192533-25e2208e0dc3
  • Fix #​7894: bump k8s.io/kube-openapi from 0.0.0-20260319004828-5883c5ee87b9 to 0.0.0-20260414162039-ec9c827d403f
  • Fix #​7875: bump vertx5.version from 5.0.12 to 5.1.1, adapting httpclient-vertx-5 to Vert.x 5.1 behaviour changes (SSL engine options no longer accept an empty protocol array; request-body stream errors are reset with HTTP/2 CANCEL so they are not retried as transient IOExceptions)
New Features
  • Fix #​7926: (httpclient-vertx-5, httpclient-vertx) opt-in TLS warm-up on the Vert.x HTTP client factory. Vertx5HttpClientFactory/VertxHttpClientFactory now expose setTlsWarmup(TlsWarmup) with modes OFF, CONTEXT (default, unchanged) and FULL. FULL runs a synchronous, once-per-JVM, throwaway loopback TLS handshake off the event loop when the client is built, so the first real connection no longer blocks the event loop on the one-time JDK/Netty TLS class loading — for users on cold or hard-CPU-throttled JVMs hitting the first-connection block/timeout described in #​7921. Default behavior is unchanged; see the FAQ for CDS and pod CPU-sizing guidance for hard-throttled pods
  • Fix #​5084: Jbang scripts to generate graalVM metadata
  • Fix #​7375: (crd-generator) Support @​JsonClassDescription for adding descriptions to classes in the generated CRD schema.
Note: Breaking changes
springdoc/springdoc-openapi (org.springdoc:springdoc-openapi-starter-webmvc-ui)

v3.1.1

Security
  • GHSA-6f5m-mhjg-qwxq – MCP tool callbacks do not encode path parameters, allowing request retargeting
  • GHSA-4v2q-56v7-2cpw – MCP transport, admin and dashboard endpoints are exposed by default
  • GHSA-m4cg-mhpg-rh2r – MCP audit events record credentials and request/response bodies without redaction
  • GHSA-5f9r-4mc4-qh3c – Unbounded MCP pending-confirmation store allows memory exhaustion
  • GHSA-jcgg-59c8-w4wh – MCP request context in a ThreadLocal can leak headers between concurrent WebFlux requests
  • GHSA-rhhx-6j8h-8cvw – Unbounded per-locale OpenAPI cache allows memory exhaustion via Accept-Language
  • GHSA-c925-vm88-mpp9 – Scalar starters trust client-supplied forwarded headers and render from a shared mutable bean
  • CVE-2026-75838 – Cross-site scripting in the DOMPurify bundled with swagger-ui, addressed by upgrading swagger-ui to 5.32.14
Added
  • #​3340 – Describe JsonNullable values without their Java wrapper
  • #​3325 – Manage the swagger artifacts in springdoc-openapi-bom, so that modules holding only the annotations stay in lockstep
  • #​3321 – Add springdoc.login-endpoint.username-example and springdoc.login-endpoint.password-example to document the Spring Security login endpoint
Changed
  • MCP is now opt-in. Set springdoc.ai.mcp.enabled=true, and springdoc.ai.mcp.dashboard-enabled=true for the dashboard
  • The Scalar starters no longer register forwarded-header handling. Set server.forward-headers-strategy=framework (or native) behind a trusted proxy
  • Add springdoc.cache.max-entries (default 100) to bound the per-locale OpenAPI cache
  • Add springdoc.ai.mcp.audit.redact (default true) to mask secrets in MCP audit events
  • Document that the MCP approval flow is a confirmation step, not an authorization control
  • Document the security policy and the release versioning scheme
  • #​3351java.time.Duration, LocalTime and OffsetTime are now resolved by swagger-core instead of being forced to a bare string, so they carry a format (duration and partial-time respectively for the first two)
  • A property whose type only implements Set indirectly (LinkedHashSet, TreeSet, …) is now described with uniqueItems: true, following swagger-api/swagger-core#5265
  • Upgrade swagger-core to version 2.2.55
  • Upgrade swagger-ui to version 5.32.14
Fixed
  • #​3328, #​3337/v3/api-docs fails with a NullPointerException when spring-hateoas is on the classpath without HateoasProperties
  • #​3314Json Processing Exception occurred is logged for every constrained parameter whose schema is not a JsonSchema
  • #​3317 – An injected HttpHeaders parameter is described as a schema
  • #​3332 – The properties a Kotlin entity inherits from an @Embeddable are missing from the Spring Data REST schemas
  • #​3320@Order and Ordered ignored when applying customizers
  • #​3319 – A Page nested in another schema is not replaced by PagedModel
  • #​3313 – Springdoc auto-configurations rely on unspecified auto-configuration ordering
  • #​3331 – Validation annotations declared inside Optional parameters are dropped
  • #​3322 – Validation annotations on a container's type argument leak between parameters
  • #​3315 – An OAS 3.1 JsonSchema cannot be cloned through JSON
  • #​3300 – TYPE_USE annotations on @ParameterObject fields are not passed along
  • #​3341 – Stabilize Spring Data Sort and Pageable schema property order
  • #​3338 – Kotlin nullability interpretation of the Any? type
  • #​3136 – A Spring Data REST association to a non-exported entity expands its @EmbeddedId and @MapsId fields recursively in the response schemas
  • The Spring Data REST response post-processing rewrote an association property in place, so the …Response refs could leak into the schema shared with the request body representation

v3.1.0

Added
  • #​3269 – Add mechanism to disable nullable for Kotlin properties
  • Allow request-specific Swagger UI index transformation
Changed
  • Upgrade Spring Boot to version 4.1.0
  • Upgrade Spring AI to version 2.0.0
  • Upgrade swagger-core to version 2.2.52
  • Upgrade swagger-ui to version 5.32.11
  • #​3307 – Act upon SonarQube warnings
  • #​3306 – Act upon SonarQube warnings
Fixed
  • #​3304 – Kotlin parent class's field is not properly marked as nullable
  • #​3294 – Duplicated path getting swagger-config
  • #​3293 – Inconsistent OpenAPI schema naming with SNAKE_CASE: some Java record fields remain camelCase
  • #​3292 – Make WebProperties and WebMvcProperties optional in SwaggerConfig
  • #​3284 – Upgrade swagger-core from version 2.2.48 to 2.2.49
  • #​3282 – Preserve version from nest() predicate across all routes in nest
  • #​3281 – Stabilize Spring Data Page schema property order
  • #​3274 – Description disappears from the generated json after upgrade to 3.0.3
  • #​3270 – Validation annotation of ParameterObject property applied to PathVariable with the same name, even in unrelated endpoints
  • #​3266 – Upgrade swagger-core from version 2.2.47 to 2.2.48
  • #​3263 – Null key for a Map not allowed in JSON
JetBrains/kotlin (org.jetbrains.kotlin.jvm)

v2.4.20

Analysis API
  • KT-86546 Check suspicious when over ConeKotlinType in ConeTypeCompatibilityChecker
  • KT-85418 Implement an API for accessing deserialized file annotations in Analysis API
  • KT-74448 K2. False positive MISSING_DEPENDENCY_SUPERCLASS in LinkedListTest.kt, kotlinx.coroutines
  • KT-85856 containingSymbol of constructor property differs for local and non-local classes
  • KT-65417 K2 IDE: KTOR false positive expect-actual matching error on enum class because of implicit clone() in non-JVM source sets
Analysis API. Code Compilation
  • KT-76457 K2 IDE / KMP Debugger: KISEWA “Cannot compile a common source without a JVM counterpart” on evaluating inline fun from common module inside jvm
Analysis API. FIR
  • KT-70552 No expects for actual
  • KT-69727 K2 IDE. Wrong error in the editor on calling clone function of actual enum instance in non-jvm platform
  • KT-69726 FP errors on declaring fun clone() in actual enum in not-jvm source-set
  • KT-86014 Types are broken after remove parameter through change signature
  • KT-86363 KotlinIllegalArgumentExceptionWithAttachments: No dangling modifier found on companion blocks
  • KT-86147 Drop kotlin.parallel.resolve.under.global.lock registry key
  • KT-85543 Avoid lazy resolve for the contracts phase if no constracts might be resolved
Analysis API. Infrastructure
  • KT-84914 Do not publish analysis-api-test-framework
  • KT-86986 kotlin-compiler-common-for-ide bundles unrelated Analysis API modules
  • KT-86186 Analysis API: Codebase tests run twice in some analysis modules — pick a single JUnit runner and migrate
  • KT-85360 Drop kotlin-compiler-testdata-for-ide artifact
  • KT-85585 Simplify the dependencies graph for the Analysis API modules
  • KT-85381 Remove tests for the FE10 implementation
Analysis API. Light Classes
New Features
  • KT-84645 Support resolving to companion block members & extensions from Java (light classes)
  • KT-80775 Support PsiClass#getRecordComponents in light classes
Fixes
  • KT-57537 SLC: propagate default parameter value from (@JvmOverloads) expect declarations to actual declarations
  • KT-85040 [Analysis API] Improve Java / Kotlin interop in KMP projects
  • KT-87301 SymbolLightAccessorMethod#isValid returns false for delegated properties
  • KT-87171 SLC: non-mapped Kotlin collection supertype is dropped from supertype list
  • KT-87250 JvmExposeBoxed: light classes shouldn't be autogenerated for private declarations
  • KT-70428 AA: good code is red when a Java class extends a Kotlin class implementing MutableList by delegation
  • KT-63568 Symbol Light Classes: KtAnnotationApplicationWithArgumentsInfo.normalizedArguments() may work incorrectly when psi is not set
  • KT-36740 MPP: False-positive incompatible types in .java when using expect-class returned by non-expect member from common when actual is actual typealias
  • KT-67749 Analysis API: Symbol Light classes should be available only to pure JVM sources
  • KT-68169 K2 IDE. KMP. False positive type mismatch in java file of jvm source-set when using common declaration which expects String
  • KT-37783 KMP Java Interop: JVM-only methods on actual superclass not resolved in Java for common subclass
  • KT-40059 Provide type correction for expect/actual types used from Java-code
  • KT-71429 MPP: False positive "Function1 is not a functional interface" when calling code from Common in Java
  • KT-70426 SLC: kotlin.Collection#size is not exposed by default
  • KT-60480 Symbol Light Classes: Classes implementing kotlin.collections.* interfaces don't implement all methods from the corresponding java.util.* interfaces
  • KT-36991 IDE: "both methods have same erasure" for Java classes directly or indirectly extending Kotlin collections
  • KT-22594 KotlinCollection.getSize is not highlighted as an error in Java
Analysis API. PSI
  • KT-84925 Move KtReference to the Kotlin IntelliJ plugin
  • KT-85052 Move mutation methods out of the Kotlin PSI
  • KT-85427 Use factory-like pattern instead of reflection in KtNodeType
  • KT-84789 Ensure all KtClassBody.parent usages are correct
  • KT-85154 PSI: "AE: parent is ERROR_ELEMENT" with top-level destructuring declaration
Analysis API. Providers and Caches
  • KT-82220 Analysis API: Support platform-specific session components and checkers in metadata sessions
  • KT-76526 Incorrect built-in module is provided for non-JVM sources in Standalone
Analysis API. Standalone
  • KT-83191 Analysis API: JvmDependenciesIndexImpl performs very poorly for large classpaths
  • KT-61404 Analysis API: implement proper library publishing structure
  • KT-85112 AA does not see packages from unpacked klibs
  • KT-86417 Support parameters in 'getExpectsForActual()'
  • KT-84916 Metadata stub deserializers aren't properly set up for Analysis API Standalone
Analysis API. Stubs and Decompilation
  • KT-86250 KotlinIllegalArgumentExceptionWithAttachments: No fir element was found for KtDestructuringDeclaration on destructuring declaration typing
  • KT-86520 KotlinDeclarationInCompiledFileSearcher doesn't support visibility-mangled declarations
  • KT-64901 Inconsistency between AST and Stub tree in the case of non-local destructuring declarations
  • KT-84444 Support stubs for companion blocks & extensions
Analysis API. Surface
New Features
  • KT-73214 Add KaScope#declarations with name filter
  • KT-69085 Provide API to retrieve label/name from KtFunctionLikeSymbol
  • KT-70771 KaLocalVariableSymbol: support isDelegatedProperty
  • KT-85037 Add API for KaFunctionType's returnType modification
  • KT-80460 AA: Introduce KtExpression.isStableForSmartCasting API
  • KT-66566 AA: api to create functional types
  • KT-65912 Analysis API: Implement type building API for all KtType
Performance Improvements
  • KT-70021 Analysis API: optimize KaFirExpressionTypeProvider.expressionType for simple cases
Fixes
  • KT-66039 K2: Analysis API: redesign resolution API
  • KT-86394 Resolve from KDoc reference is inconsistent with source code
  • KT-87337 Integrate KaContextParameterOwnerSymbol into KaCallableSymbol
  • KT-78234 Analysis API: Context parameters for accessors
  • KT-86786 Investigate suspicious when over ConeKotlinType in ConeKotlinType.getDirectSupertypes
  • KT-72902 Shouldn't KaSymbolProvider#findClass return KaNamedClassSymbol?
  • KT-87237 No expected type inside arrayOf in annotation entries
  • KT-87143 findKDoc returns parent property KDoc for accessors of an overriding property
  • KT-83224 Support "Compile-time functions" in the Analysis API
  • KT-87174 Expected class KaFirSymbol instead of class KaFirPackageSymbol exception
  • KT-87199 [Analysis API] Remove KaEnumEntryInitializerSymbol
  • KT-85382 Remove the FE10 implementation
  • KT-70774 Unary operators on literals are not resolvable
  • KT-85206 Provide information about potentially removable context-sensitive resolution qualifiers via Analysis API
  • KT-86872 KtOperationReferenceExpression should be KtResolvableCall
  • KT-85800 Analysis API: The internal utility PrettyPrinter is used in the public API surface
  • KT-73796 Consider "KaAnnotation#useSiteTarget" removal
  • KT-70794 K2 IDE: Reference to object does not resolve as LHS in "plusAssign" assignment expression
  • KT-86757 Flaky annotations result for @all annotation on a backing field
  • KT-86681 [Analysis API] Move isDelegated to KaVariableSymbol
  • KT-86685 collectCallCandidates works incorrectly for a constructor vs. a companion invoke
  • KT-86514 No expected type within collection literal in annotation entry using array rather than varargs
  • KT-76076 K2 AA: safe call expression navigates to parent array index access expression
  • KT-86418 Support property accessors in 'getExpectsForActual()'
  • KT-71312 KaFirPsiJavaClassSymbol.{hasAnnotations, annotationSimpleNames} is inconsistent with FirJavaClass implementation
  • KT-86248 isUsedAsExpression true for typealias lhs in ::
  • KT-85778 Analysis API: Ensure that all public endpoints in implementation modules are internal or opt-in
  • KT-78285 resolveToCallCandidates inconsistent behaviour with invoke operator and constructor
  • KT-85852 CCE in buildClassType
  • KT-85989 Super type references should be aware of type alias constructors
  • KT-84184 [Analysis API] Provide a unification substitutor API
  • KT-84584 Support companion extensions and blocks in the Analysis API
  • KT-84932 Deprecate utilities exposed through analysis-internal-utils
  • KT-73059 Consider dropping of KaOriginalPsiProvider
  • KT-73050 KaFirSymbolRelationProvider#expectsForActual: suspicius logic for KaReceiverParameterSymbol
  • KT-71101 [AA] Consider getting rid of KaTypeNullability
Backend. J2KLIB
  • KT-88165 Add Support for -XheaderModeType=compilation to improve header compilation performance
  • KT-86239 [JKLIB] Investigate which type system context is needed in JklibIrLinker
  • KT-88306 [JKLIB] Unbound symbols for kotlin.coroutines.SuspendFunctionN
  • KT-88120 [JKLIB] Add -jvm-target to K2JKlibCompilerArguments
  • KT-88176 [JKLIB] DeserializationStrategy.WITH_INLINE_BODIES when deserializaing dependencies
  • KT-88163 Allow to disable firAggressivePrunner for Jklib
Backend. Native. Debug
  • KT-85264 [Native] Stepping trace starts with // test.kt:1 box in some debug stepping tests
  • KT-81740 Native: importing konan_lldb.py to lldb prints a warning
Backend. Wasm
Fixes
  • KT-73452 K/Wasm: turning on range checks by default
  • KT-83171 K/Wasm: Investigate import.meta usage in mjs files
  • KT-83159 K/Wasm: generate one common base class fun interfaces (including Function*)
  • KT-82843 K/Wasm: pass a lambda call helpers to convert funs as an argument instead of exporting them
  • KT-86123 [Wasm] Callable reference refactoring (KT-83159) broke klib binary compatibility with libraries compiled by Kotlin 2.0.x
  • KT-83356 K/Wasm: Difference in behavior on nested class initialization (for enums?)
  • KT-87639 [Wasm] Multimodule wasm fails on Pointer usages
  • KT-87583 Wasm IC cache is not invalidated when kotlin.wasm.compilationMode changes causing IndexOutOfBoundsException in WasmDeserializer
  • KT-84267 K/Wasm: init order of companion objects is different from JVM
  • KT-86192 K/Wasm: Raise a warning on usage of top-level require in JsFun
  • KT-86242 K/Wasm: deprecate and prohibit using wasmExports
  • KT-86245 K/Wasm: provide an API to get a reference to wasm memory
  • KT-84610 [Wasm] Failed to compile klibs in IC mode
  • KT-87078 Wasm/JS: OutOfMemoryError (or BufferUnderflowException) during incremental compilation of multiple files with @JsExport
  • KT-76207 K/Wasm: prototype generating suspend functions with stack-switching proposal
  • KT-86166 [Wasm] Make possible to have passing test in multimodule but having it fail in monolith
  • KT-71039 [Wasm, IC] Investigate synthetic function types loading
  • KT-71505 [Wasm, IC] Incremental step can produce wrong main function call
  • KT-86822 K/Wasm: don't cast the result of calling callable references with Unit return type
  • KT-86180 [Wasm] backward compatibility is broken in 2.1->2.2 by changed order of type parameters
  • KT-86640 [wasm]: Single-module test failures with companion object initializers
  • KT-66105 Wasm: SyntaxError: Identifier 'box' has already been declared
  • KT-83245 K/Wasm: Run stepping tests with local variables with K/Wasm
  • KT-86478 K/Wasm JS: StringBuilder.setLength crashes when growing with js-string builtins
  • KT-84667 wasm: Add general support for custom sections/annotations
  • KT-85506 [Wasm/WASI] Stdlib readLn and readlnOrNull implementation
  • KT-85270 K/Wasm: incremental compilation fails with NoSuchElementException when a stdlib call is removed
Compiler
New Features
  • KT-73431 Unresolved reference errors should state the type they're acting on
  • KT-80373 Add initial support for release compiler caches
  • KT-84618 Emit a warning when an undesrcore variable is assigned to a Unit expression
  • KT-86409 [KMP] Create JVM IC metadata output
  • KT-84295 Support Companion Block of Operator for Collection Literals
  • KT-84956 Resolve of references to static & companion object members of generic class
  • KT-85925 Native: rework virtual trampolines machinery
  • KT-86657 Native: turn on incremental compilation by default
  • KT-86018 Short-form of name-based destructuring for multi-field value classes
  • KT-86406 Swift Export: support supercalls for cross-language inheritance
  • KT-77616 Native: consider adding an annotation that enforces thread state switching for a @SymbolName external fun`
  • KT-86410 [KMP] Implement acceptance of JVM IC metadata from previous compilation
  • KT-85593 ELA: Support multiple lambda arguments
  • KT-83040 Collection literals: ensure normal interaction with CFG
  • KT-84333 Collection literals: type inference in delegate expression
  • KT-84289 Resolution to Companion Block & Extension Invoke Operator
  • KT-82961 Type inference from upper type for type parameters designed for tracking of checked exceptions
  • KT-81444 False positive: "Overload resolution ambiguity" with @OverloadResolutionByLambdaReturnType and multiple lambda parameters
  • KT-75736 Enable reading/writing annotations in metadata on JVM by default
Performance Improvements
  • KT-85621 Native: fix optimization in CastsOptimization
  • KT-69758 FastJarFS - avoid copying data on inflating (JDK 16+)
  • KT-85647 Compilation performance regression in AbstractFirDeserializedSymbolProvider since 2.3.20
  • KT-86104 [JVM] use static methods/fields of KTypeProjection in typeOf genera

Important

✂ PR body was truncated to here.


Configuration

📅 Schedule: (in timezone Etc/UTC)

  • Branch creation
    • "after 02:00 and before 06:00 every weekday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added component: dependencies Dependency update or dependency policy. dependencies Dependency update, lockfile change, or dependency policy. priority: P2 Medium; normal planned work. type: chore Maintenance work without intended behavior change. labels Sep 14, 2026
@renovate
renovate Bot force-pushed the renovate/minor-and-patch-dependencies branch 3 times, most recently from 6a01517 to 2bcca41 Compare September 16, 2026 12:20
@renovate
renovate Bot force-pushed the renovate/minor-and-patch-dependencies branch from 2bcca41 to 6a30335 Compare September 17, 2026 16:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

component: dependencies Dependency update or dependency policy. dependencies Dependency update, lockfile change, or dependency policy. priority: P2 Medium; normal planned work. type: chore Maintenance work without intended behavior change.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants