[dependabot]

Bumps io.ktor:ktor-bom from 3.0.0 to 3.6.1.

Release notes

Sourced from io.ktor:ktor-bom's releases.

3.6.1

Published 29 October 2026

Improvements

• KTOR-10005 Native accepted TCP sockets do not enable TCP_NODELAY, unlike JVM
• KTOR-9966 Netty poor performance on delay calls
• KTOR-4206 The "com.typesafe.config.ConfigException$Missing" exception leaks from the typesafe config library when configuration is merged

Bugfixes

• KTOR-10037 CIO: keep-alive connection hangs when a response fails before writing any bytes
• KTOR-9969 Kotlin/Native CIO server occasionally closes an accepted connection with zero response bytes under CPU load
• KTOR-9974 CIO: close_notify is written concurrently with the last record, corrupting the TLS output and the kotlinx-io segment pool
• KTOR-9925 Resources: Constant sibling route loses to parameterized one when routes are split across separate authenticate blocks
• KTOR-9938 Apache5: streaming response hangs when the block returns before the body arrives
• KTOR-10023 Ktor 3.6.0 no longer throws BadRequestException for malformed paths
• KTOR-9986 HttpRedirect: a relative Location with dot segments is not normalized, so most engines send .. in the request path
• KTOR-10085 ETags: Ignore If-Modified-Since when If-None-Match is present
• KTOR-9430 DI: resources are not cleaned up during testing with testApplication
• KTOR-7175 Ktor-client, connections leak
• KTOR-9848 Android: The Android engine crashes with Unbalanced enter/exit on response read cancellation
• KTOR-9994 Android engine closes RawSourceChannel on the main thread and crashes with NetworkOnMainThreadException
• KTOR-9959 Sockets: CIO writer busy-loops when a nonblocking write returns zero
• KTOR-9970 Java: Cancelling a request before response headers does not abort the HTTP exchange
• KTOR-10006 OpenAPI: Compiler crash on local variable using object expression
• KTOR-9972 Android: DiskReadViolation when KtorSimpleLogger is initialized during plugin execution
• KTOR-9985 OpenAPI compiler plugin duplicates unrelated schemas (FooDTO -> FooDTO2) after adding new routes
• KTOR-2348 DoubleReceive: recursive receive pipeline re-entry when receiving content in a receivePipeline interceptor
• KTOR-9968 Test engine streaming responses hang when over 1MB
• KTOR-9894 Netty + Compression: response leaked when the client disconnects before the body is written
• KTOR-9987 WebSockets: Netty sometimes closes socket before sending close frame
• KTOR-9943 HttpStatement.execute can hang when its block abandons a response body
• KTOR-9980 CallLogging: MDC entries leak stale thread-local values when provider returns null
• KTOR-9790 testApplication: sseSession() never returns when the SSE route installs a heartbeat
• KTOR-9884 Directories are returned as empty binaries when using nested jars
• KTOR-4245 Code snippet in Kdoc for DefaultRequest doesn't compile
• KTOR-10035 WebSocket drops the queued Close frame when the server session fails
• KTOR-10036 testApplication: WebSocket client stops reading before the servers Close reply arrives

3.6.0

Published 16 September 2026

Features

• KTOR-8596 OpenID Connect (OAuth2) auto-discover & configuration
• KTOR-9645 Client curated multi-platform facade module
• KTOR-8883 Support nested jars in static resources
• KTOR-8672 Support at least zstd and deflate formats of precompressed files
• KTOR-8595 Auth JWK Support (auto-discover)
• KTOR-9841 OIDC Server Plugin
• KTOR-9654 Override fetch in JS engine
• KTOR-9785 Typesafe Authentication DSL

... (truncated)

Changelog

Sourced from io.ktor:ktor-bom's changelog.

3.6.1

Published 29 October 2026

Improvements

• KTOR-10005 Native accepted TCP sockets do not enable TCP_NODELAY, unlike JVM
• KTOR-9966 Netty poor performance on delay calls
• KTOR-4206 The "com.typesafe.config.ConfigException$Missing" exception leaks from the typesafe config library when configuration is merged

Bugfixes

• KTOR-10037 CIO: keep-alive connection hangs when a response fails before writing any bytes
• KTOR-9969 Kotlin/Native CIO server occasionally closes an accepted connection with zero response bytes under CPU load
• KTOR-9974 CIO: close_notify is written concurrently with the last record, corrupting the TLS output and the kotlinx-io segment pool
• KTOR-9925 Resources: Constant sibling route loses to parameterized one when routes are split across separate authenticate blocks
• KTOR-9938 Apache5: streaming response hangs when the block returns before the body arrives
• KTOR-10023 Ktor 3.6.0 no longer throws BadRequestException for malformed paths
• KTOR-9986 HttpRedirect: a relative Location with dot segments is not normalized, so most engines send .. in the request path
• KTOR-10085 ETags: Ignore If-Modified-Since when If-None-Match is present
• KTOR-9430 DI: resources are not cleaned up during testing with testApplication
• KTOR-7175 Ktor-client, connections leak
• KTOR-9848 Android: The Android engine crashes with Unbalanced enter/exit on response read cancellation
• KTOR-9994 Android engine closes RawSourceChannel on the main thread and crashes with NetworkOnMainThreadException
• KTOR-9959 Sockets: CIO writer busy-loops when a nonblocking write returns zero
• KTOR-9970 Java: Cancelling a request before response headers does not abort the HTTP exchange
• KTOR-10006 OpenAPI: Compiler crash on local variable using object expression
• KTOR-9972 Android: DiskReadViolation when KtorSimpleLogger is initialized during plugin execution
• KTOR-9985 OpenAPI compiler plugin duplicates unrelated schemas (FooDTO -> FooDTO2) after adding new routes
• KTOR-2348 DoubleReceive: recursive receive pipeline re-entry when receiving content in a receivePipeline interceptor
• KTOR-9968 Test engine streaming responses hang when over 1MB
• KTOR-9894 Netty + Compression: response leaked when the client disconnects before the body is written
• KTOR-9987 WebSockets: Netty sometimes closes socket before sending close frame
• KTOR-9943 HttpStatement.execute can hang when its block abandons a response body
• KTOR-9980 CallLogging: MDC entries leak stale thread-local values when provider returns null
• KTOR-9790 testApplication: sseSession() never returns when the SSE route installs a heartbeat
• KTOR-9884 Directories are returned as empty binaries when using nested jars
• KTOR-4245 Code snippet in Kdoc for DefaultRequest doesn't compile
• KTOR-10035 WebSocket drops the queued Close frame when the server session fails
• KTOR-10036 testApplication: WebSocket client stops reading before the servers Close reply arrives

3.6.0

Published 16 September 2026

Features

• KTOR-8596 OpenID Connect (OAuth2) auto-discover & configuration
• KTOR-9645 Client curated multi-platform facade module
• KTOR-8883 Support nested jars in static resources
• KTOR-8672 Support at least zstd and deflate formats of precompressed files
• KTOR-8595 Auth JWK Support (auto-discover)
• KTOR-9841 OIDC Server Plugin
• KTOR-9654 Override fetch in JS engine

... (truncated)

Commits

• 26cc003 Release 3.6.1 (#5970)
• b4fc04d KTOR-10035 Deliver the queued Close frame when the session fails (#5959)
• fbd2a80 KTOR-10036 Keep the test host WebSocket client reading until the server close...
• 516fe19 KTOR-10037 Close the CIO connection when a response fails before writing any ...
• 3954d0c KTOR-9938: Abort Apache5 exchanges when the response body is cancelled
• dbc9692 KTOR-9969 Shut down native socket output inside the writer coroutine
• 3ceecd7 KTOR-9992 Fix CIO accept busy loop (#5961)
• bdfff2b KTOR-10023 Throw BadRequestException on malformed URL segments
• 7378949 KTOR-9986 Remove dot segments from relative redirect targets (#5939)
• c981394 KTOR-9430 Fix test server stopping
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[sentry]

📲 Install Builds

Android

🔗 App Name	App ID	Version	Configuration
SDK Size	io.sentry.tests.size	8.64.0 (1)	release

⚙️ sentry-android Build Distribution Settings

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 19fe9c8. Configure here.}

[cursor]

Ktor 3.0 matrix pin overwritten

Medium Severity

The testKtor300 suite is a compatibility matrix pin for Ktor 3.0.0, while the default test suite already runs against catalog ktorClient 3.6.1. Replacing enforcedPlatform("io.ktor:ktor-bom:3.0.0") with 3.6.1 makes both suites identical and drops coverage that sentry-ktor-client still works on the oldest supported Ktor 3 line. This is an unintentional matrix bump, not a latest-version upgrade.

 

^{Triggered by project rule: PR Review Guidelines for Cursor Bugbot}

^{Reviewed by Cursor Bugbot for commit 19fe9c8. Configure here.}