Skip to content

deps(deps): bump ktor from 3.4.0 to 3.4.1#598

Merged
rustyrazorblade merged 1 commit intomainfrom
dependabot/gradle/ktor-3.4.1
Mar 26, 2026
Merged

deps(deps): bump ktor from 3.4.0 to 3.4.1#598
rustyrazorblade merged 1 commit intomainfrom
dependabot/gradle/ktor-3.4.1

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Mar 23, 2026

Bumps ktor from 3.4.0 to 3.4.1.
Updates io.ktor:ktor-server-core from 3.4.0 to 3.4.1

Release notes

Sourced from io.ktor:ktor-server-core's releases.

3.4.1

Published 3 March 2026

Improvements

  • KTOR-9382 HttpProtocolVersion.parse: fast path for common versions
  • KTOR-9381 GMTDate: reduce allocations
  • KTOR-8971 Support "operationId" in Kdoc for OpenAPI spec. gen.
  • KTOR-9333 WebSockets: Infinite spin and potential OOM vulnerabilities in the Inflater.inflateFully method
  • KTOR-5616 Ktor always adds by default an Accept-Charset header
  • KTOR-9291 OpenAPI: handle atypical route functions
  • KTOR-9293 OpenAPI describe needs defaults
  • KTOR-9304 OpenAPI: Order of path parameters is not preserved in the spec
  • KTOR-9353 Routing: TailcardSelector missing toString(), which clutters the logs

Bugfixes

  • KTOR-9281 OpenApi code inference misses lambda argument bodies
  • KTOR-9273 OpenAPI static content path appears in resulting model
  • KTOR-9004 OpenAPI: No respective formats detected for serializable types like UUID or Instant
  • KTOR-9305 OpenAPI: "No mapping for symbol: VAR FOR_LOOP_VARIABLE" error with codeInferenceEnabled=true
  • KTOR-9279 OpenAPI: UnsupportedOperationException for a function with a reified type parameter codeInferenceEnabled = true
  • KTOR-9289 OpenAPI: Resource routes are missing inferred and comment-based documentation
  • KTOR-9330 OpenAPI: Cannot override kotlinx.serialization module
  • KTOR-9320 OpenAPI: jsonSchema() does not unwrap Kotlin value classes (inline classes)
  • KTOR-9352 Authentication: Creating JWT verifier fails for JWK with kty=EC and alg=null
  • KTOR-9344 Flow invariant error happens after update to Ktor 3.4.0
  • KTOR-9362 testApplication: Race condition in timeout coroutine when response is streaming
  • KTOR-9274 Curl: Undefined symbol errors when linking on Linux since 3.4.0
  • KTOR-8782 NodeJS CIO: "Module 'os' could not be imported" error on resolving WORKING_DIRECTORY_PATH with es2015 target
  • KTOR-9348 String.decodeBase64String fails to decode when the input has no padding since 3.4.0
  • KTOR-9318 CIO engine rejects valid certificates with unsupported signature algorithms
  • KTOR-9331 Curl: Segfaults when working with WebSockets
  • KTOR-9334 Coroutines in route handlers are dispatched with Dispatchers.Unconfined since 3.2.0
  • KTOR-9339 StreamResetException is not propagated to the caller of StreamRequestBody.writeTo since 3.4.0
  • KTOR-9329 HTMX: "on" attributes extension not working
  • KTOR-9316 WasmJS bad get and set implementations for Uint8Array and ArrayLike
  • KTOR-9272 JSON schema inference does not recognize unsigned types
  • KTOR-9211 SendCountExceedException when request is sent twice with maxRetries = 0 since 3.3.2
  • KTOR-9285 RateLimit: Milliseconds in the Retry-After header are truncated
  • KTOR-7512 JWT: Docs for validate method claim that it's optional, but it isn't
  • KTOR-9269 Incorrect dependency declaration in swagger / openapi
  • KTOR-9372 Frame.Text.readText() causes infinite loop and 100% CPU on Kotlin/Native when WebSocket frame data is malformed or connection drops unexpectedly
Changelog

Sourced from io.ktor:ktor-server-core's changelog.

3.4.1

Published 3 March 2026

Improvements

  • KTOR-9382 HttpProtocolVersion.parse: fast path for common versions
  • KTOR-9381 GMTDate: reduce allocations
  • KTOR-8971 Support "operationId" in Kdoc for OpenAPI spec. gen.
  • KTOR-9333 WebSockets: Infinite spin and potential OOM vulnerabilities in the Inflater.inflateFully method
  • KTOR-5616 Ktor always adds by default an Accept-Charset header
  • KTOR-9291 OpenAPI: handle atypical route functions
  • KTOR-9293 OpenAPI describe needs defaults
  • KTOR-9304 OpenAPI: Order of path parameters is not preserved in the spec
  • KTOR-9353 Routing: TailcardSelector missing toString(), which clutters the logs

Bugfixes

  • KTOR-9281 OpenApi code inference misses lambda argument bodies
  • KTOR-9273 OpenAPI static content path appears in resulting model
  • KTOR-9004 OpenAPI: No respective formats detected for serializable types like UUID or Instant
  • KTOR-9305 OpenAPI: "No mapping for symbol: VAR FOR_LOOP_VARIABLE" error with codeInferenceEnabled=true
  • KTOR-9279 OpenAPI: UnsupportedOperationException for a function with a reified type parameter codeInferenceEnabled = true
  • KTOR-9289 OpenAPI: Resource routes are missing inferred and comment-based documentation
  • KTOR-9330 OpenAPI: Cannot override kotlinx.serialization module
  • KTOR-9320 OpenAPI: jsonSchema() does not unwrap Kotlin value classes (inline classes)
  • KTOR-9352 Authentication: Creating JWT verifier fails for JWK with kty=EC and alg=null
  • KTOR-9344 Flow invariant error happens after update to Ktor 3.4.0
  • KTOR-9362 testApplication: Race condition in timeout coroutine when response is streaming
  • KTOR-9274 Curl: Undefined symbol errors when linking on Linux since 3.4.0
  • KTOR-8782 NodeJS CIO: "Module 'os' could not be imported" error on resolving WORKING_DIRECTORY_PATH with es2015 target
  • KTOR-9348 String.decodeBase64String fails to decode when the input has no padding since 3.4.0
  • KTOR-9318 CIO engine rejects valid certificates with unsupported signature algorithms
  • KTOR-9331 Curl: Segfaults when working with WebSockets
  • KTOR-9334 Coroutines in route handlers are dispatched with Dispatchers.Unconfined since 3.2.0
  • KTOR-9339 StreamResetException is not propagated to the caller of StreamRequestBody.writeTo since 3.4.0
  • KTOR-9329 HTMX: "on" attributes extension not working
  • KTOR-9316 WasmJS bad get and set implementations for Uint8Array and ArrayLike
  • KTOR-9272 JSON schema inference does not recognize unsigned types
  • KTOR-9211 SendCountExceedException when request is sent twice with maxRetries = 0 since 3.3.2
  • KTOR-9285 RateLimit: Milliseconds in the Retry-After header are truncated
  • KTOR-7512 JWT: Docs for validate method claim that it's optional, but it isn't
  • KTOR-9269 Incorrect dependency declaration in swagger / openapi
  • KTOR-9372 Frame.Text.readText() causes infinite loop and 100% CPU on Kotlin/Native when WebSocket frame data is malformed or connection drops unexpectedly
Commits
  • c6c1a5c Release 3.4.1 (#5410)
  • 8c6ef88 KTOR-9353: Override toString for TailcardSelector and LocalPortRouteSelector ...
  • a6aed07 Follow-up KTOR-9333 Preserve inflater context (#5403)
  • a6bd1d3 KTOR-9344 Disable switching to engine dispatcher by default (#5408)
  • f557ef7 Add constraints for vulnerable dependencies (#5405)
  • a5b2eb6 KTOR-9352 Handle EC key type when JWK algorithm is null (#5387)
  • a971317 KTOR-9362 Catch ClosedWriteChannelException in the timeout coroutine to avoid...
  • a23c454 Add fix-bug Claude Code skill for automated bug fixing workflow (#5386)
  • 419f1fc GMTDate: zero-allocation timestamp conversion on JVM (#5380)
  • a07f463 Add workflow to close issues after 30 days of inactivity waiting for a reply ...
  • Additional commits viewable in compare view

Updates io.ktor:ktor-server-netty from 3.4.0 to 3.4.1

Release notes

Sourced from io.ktor:ktor-server-netty's releases.

3.4.1

Published 3 March 2026

Improvements

  • KTOR-9382 HttpProtocolVersion.parse: fast path for common versions
  • KTOR-9381 GMTDate: reduce allocations
  • KTOR-8971 Support "operationId" in Kdoc for OpenAPI spec. gen.
  • KTOR-9333 WebSockets: Infinite spin and potential OOM vulnerabilities in the Inflater.inflateFully method
  • KTOR-5616 Ktor always adds by default an Accept-Charset header
  • KTOR-9291 OpenAPI: handle atypical route functions
  • KTOR-9293 OpenAPI describe needs defaults
  • KTOR-9304 OpenAPI: Order of path parameters is not preserved in the spec
  • KTOR-9353 Routing: TailcardSelector missing toString(), which clutters the logs

Bugfixes

  • KTOR-9281 OpenApi code inference misses lambda argument bodies
  • KTOR-9273 OpenAPI static content path appears in resulting model
  • KTOR-9004 OpenAPI: No respective formats detected for serializable types like UUID or Instant
  • KTOR-9305 OpenAPI: "No mapping for symbol: VAR FOR_LOOP_VARIABLE" error with codeInferenceEnabled=true
  • KTOR-9279 OpenAPI: UnsupportedOperationException for a function with a reified type parameter codeInferenceEnabled = true
  • KTOR-9289 OpenAPI: Resource routes are missing inferred and comment-based documentation
  • KTOR-9330 OpenAPI: Cannot override kotlinx.serialization module
  • KTOR-9320 OpenAPI: jsonSchema() does not unwrap Kotlin value classes (inline classes)
  • KTOR-9352 Authentication: Creating JWT verifier fails for JWK with kty=EC and alg=null
  • KTOR-9344 Flow invariant error happens after update to Ktor 3.4.0
  • KTOR-9362 testApplication: Race condition in timeout coroutine when response is streaming
  • KTOR-9274 Curl: Undefined symbol errors when linking on Linux since 3.4.0
  • KTOR-8782 NodeJS CIO: "Module 'os' could not be imported" error on resolving WORKING_DIRECTORY_PATH with es2015 target
  • KTOR-9348 String.decodeBase64String fails to decode when the input has no padding since 3.4.0
  • KTOR-9318 CIO engine rejects valid certificates with unsupported signature algorithms
  • KTOR-9331 Curl: Segfaults when working with WebSockets
  • KTOR-9334 Coroutines in route handlers are dispatched with Dispatchers.Unconfined since 3.2.0
  • KTOR-9339 StreamResetException is not propagated to the caller of StreamRequestBody.writeTo since 3.4.0
  • KTOR-9329 HTMX: "on" attributes extension not working
  • KTOR-9316 WasmJS bad get and set implementations for Uint8Array and ArrayLike
  • KTOR-9272 JSON schema inference does not recognize unsigned types
  • KTOR-9211 SendCountExceedException when request is sent twice with maxRetries = 0 since 3.3.2
  • KTOR-9285 RateLimit: Milliseconds in the Retry-After header are truncated
  • KTOR-7512 JWT: Docs for validate method claim that it's optional, but it isn't
  • KTOR-9269 Incorrect dependency declaration in swagger / openapi
  • KTOR-9372 Frame.Text.readText() causes infinite loop and 100% CPU on Kotlin/Native when WebSocket frame data is malformed or connection drops unexpectedly
Changelog

Sourced from io.ktor:ktor-server-netty's changelog.

3.4.1

Published 3 March 2026

Improvements

  • KTOR-9382 HttpProtocolVersion.parse: fast path for common versions
  • KTOR-9381 GMTDate: reduce allocations
  • KTOR-8971 Support "operationId" in Kdoc for OpenAPI spec. gen.
  • KTOR-9333 WebSockets: Infinite spin and potential OOM vulnerabilities in the Inflater.inflateFully method
  • KTOR-5616 Ktor always adds by default an Accept-Charset header
  • KTOR-9291 OpenAPI: handle atypical route functions
  • KTOR-9293 OpenAPI describe needs defaults
  • KTOR-9304 OpenAPI: Order of path parameters is not preserved in the spec
  • KTOR-9353 Routing: TailcardSelector missing toString(), which clutters the logs

Bugfixes

  • KTOR-9281 OpenApi code inference misses lambda argument bodies
  • KTOR-9273 OpenAPI static content path appears in resulting model
  • KTOR-9004 OpenAPI: No respective formats detected for serializable types like UUID or Instant
  • KTOR-9305 OpenAPI: "No mapping for symbol: VAR FOR_LOOP_VARIABLE" error with codeInferenceEnabled=true
  • KTOR-9279 OpenAPI: UnsupportedOperationException for a function with a reified type parameter codeInferenceEnabled = true
  • KTOR-9289 OpenAPI: Resource routes are missing inferred and comment-based documentation
  • KTOR-9330 OpenAPI: Cannot override kotlinx.serialization module
  • KTOR-9320 OpenAPI: jsonSchema() does not unwrap Kotlin value classes (inline classes)
  • KTOR-9352 Authentication: Creating JWT verifier fails for JWK with kty=EC and alg=null
  • KTOR-9344 Flow invariant error happens after update to Ktor 3.4.0
  • KTOR-9362 testApplication: Race condition in timeout coroutine when response is streaming
  • KTOR-9274 Curl: Undefined symbol errors when linking on Linux since 3.4.0
  • KTOR-8782 NodeJS CIO: "Module 'os' could not be imported" error on resolving WORKING_DIRECTORY_PATH with es2015 target
  • KTOR-9348 String.decodeBase64String fails to decode when the input has no padding since 3.4.0
  • KTOR-9318 CIO engine rejects valid certificates with unsupported signature algorithms
  • KTOR-9331 Curl: Segfaults when working with WebSockets
  • KTOR-9334 Coroutines in route handlers are dispatched with Dispatchers.Unconfined since 3.2.0
  • KTOR-9339 StreamResetException is not propagated to the caller of StreamRequestBody.writeTo since 3.4.0
  • KTOR-9329 HTMX: "on" attributes extension not working
  • KTOR-9316 WasmJS bad get and set implementations for Uint8Array and ArrayLike
  • KTOR-9272 JSON schema inference does not recognize unsigned types
  • KTOR-9211 SendCountExceedException when request is sent twice with maxRetries = 0 since 3.3.2
  • KTOR-9285 RateLimit: Milliseconds in the Retry-After header are truncated
  • KTOR-7512 JWT: Docs for validate method claim that it's optional, but it isn't
  • KTOR-9269 Incorrect dependency declaration in swagger / openapi
  • KTOR-9372 Frame.Text.readText() causes infinite loop and 100% CPU on Kotlin/Native when WebSocket frame data is malformed or connection drops unexpectedly
Commits
  • c6c1a5c Release 3.4.1 (#5410)
  • 8c6ef88 KTOR-9353: Override toString for TailcardSelector and LocalPortRouteSelector ...
  • a6aed07 Follow-up KTOR-9333 Preserve inflater context (#5403)
  • a6bd1d3 KTOR-9344 Disable switching to engine dispatcher by default (#5408)
  • f557ef7 Add constraints for vulnerable dependencies (#5405)
  • a5b2eb6 KTOR-9352 Handle EC key type when JWK algorithm is null (#5387)
  • a971317 KTOR-9362 Catch ClosedWriteChannelException in the timeout coroutine to avoid...
  • a23c454 Add fix-bug Claude Code skill for automated bug fixing workflow (#5386)
  • 419f1fc GMTDate: zero-allocation timestamp conversion on JVM (#5380)
  • a07f463 Add workflow to close issues after 30 days of inactivity waiting for a reply ...
  • Additional commits viewable in compare view

Updates io.ktor:ktor-server-content-negotiation from 3.4.0 to 3.4.1

Release notes

Sourced from io.ktor:ktor-server-content-negotiation's releases.

3.4.1

Published 3 March 2026

Improvements

  • KTOR-9382 HttpProtocolVersion.parse: fast path for common versions
  • KTOR-9381 GMTDate: reduce allocations
  • KTOR-8971 Support "operationId" in Kdoc for OpenAPI spec. gen.
  • KTOR-9333 WebSockets: Infinite spin and potential OOM vulnerabilities in the Inflater.inflateFully method
  • KTOR-5616 Ktor always adds by default an Accept-Charset header
  • KTOR-9291 OpenAPI: handle atypical route functions
  • KTOR-9293 OpenAPI describe needs defaults
  • KTOR-9304 OpenAPI: Order of path parameters is not preserved in the spec
  • KTOR-9353 Routing: TailcardSelector missing toString(), which clutters the logs

Bugfixes

  • KTOR-9281 OpenApi code inference misses lambda argument bodies
  • KTOR-9273 OpenAPI static content path appears in resulting model
  • KTOR-9004 OpenAPI: No respective formats detected for serializable types like UUID or Instant
  • KTOR-9305 OpenAPI: "No mapping for symbol: VAR FOR_LOOP_VARIABLE" error with codeInferenceEnabled=true
  • KTOR-9279 OpenAPI: UnsupportedOperationException for a function with a reified type parameter codeInferenceEnabled = true
  • KTOR-9289 OpenAPI: Resource routes are missing inferred and comment-based documentation
  • KTOR-9330 OpenAPI: Cannot override kotlinx.serialization module
  • KTOR-9320 OpenAPI: jsonSchema() does not unwrap Kotlin value classes (inline classes)
  • KTOR-9352 Authentication: Creating JWT verifier fails for JWK with kty=EC and alg=null
  • KTOR-9344 Flow invariant error happens after update to Ktor 3.4.0
  • KTOR-9362 testApplication: Race condition in timeout coroutine when response is streaming
  • KTOR-9274 Curl: Undefined symbol errors when linking on Linux since 3.4.0
  • KTOR-8782 NodeJS CIO: "Module 'os' could not be imported" error on resolving WORKING_DIRECTORY_PATH with es2015 target
  • KTOR-9348 String.decodeBase64String fails to decode when the input has no padding since 3.4.0
  • KTOR-9318 CIO engine rejects valid certificates with unsupported signature algorithms
  • KTOR-9331 Curl: Segfaults when working with WebSockets
  • KTOR-9334 Coroutines in route handlers are dispatched with Dispatchers.Unconfined since 3.2.0
  • KTOR-9339 StreamResetException is not propagated to the caller of StreamRequestBody.writeTo since 3.4.0
  • KTOR-9329 HTMX: "on" attributes extension not working
  • KTOR-9316 WasmJS bad get and set implementations for Uint8Array and ArrayLike
  • KTOR-9272 JSON schema inference does not recognize unsigned types
  • KTOR-9211 SendCountExceedException when request is sent twice with maxRetries = 0 since 3.3.2
  • KTOR-9285 RateLimit: Milliseconds in the Retry-After header are truncated
  • KTOR-7512 JWT: Docs for validate method claim that it's optional, but it isn't
  • KTOR-9269 Incorrect dependency declaration in swagger / openapi
  • KTOR-9372 Frame.Text.readText() causes infinite loop and 100% CPU on Kotlin/Native when WebSocket frame data is malformed or connection drops unexpectedly
Changelog

Sourced from io.ktor:ktor-server-content-negotiation's changelog.

3.4.1

Published 3 March 2026

Improvements

  • KTOR-9382 HttpProtocolVersion.parse: fast path for common versions
  • KTOR-9381 GMTDate: reduce allocations
  • KTOR-8971 Support "operationId" in Kdoc for OpenAPI spec. gen.
  • KTOR-9333 WebSockets: Infinite spin and potential OOM vulnerabilities in the Inflater.inflateFully method
  • KTOR-5616 Ktor always adds by default an Accept-Charset header
  • KTOR-9291 OpenAPI: handle atypical route functions
  • KTOR-9293 OpenAPI describe needs defaults
  • KTOR-9304 OpenAPI: Order of path parameters is not preserved in the spec
  • KTOR-9353 Routing: TailcardSelector missing toString(), which clutters the logs

Bugfixes

  • KTOR-9281 OpenApi code inference misses lambda argument bodies
  • KTOR-9273 OpenAPI static content path appears in resulting model
  • KTOR-9004 OpenAPI: No respective formats detected for serializable types like UUID or Instant
  • KTOR-9305 OpenAPI: "No mapping for symbol: VAR FOR_LOOP_VARIABLE" error with codeInferenceEnabled=true
  • KTOR-9279 OpenAPI: UnsupportedOperationException for a function with a reified type parameter codeInferenceEnabled = true
  • KTOR-9289 OpenAPI: Resource routes are missing inferred and comment-based documentation
  • KTOR-9330 OpenAPI: Cannot override kotlinx.serialization module
  • KTOR-9320 OpenAPI: jsonSchema() does not unwrap Kotlin value classes (inline classes)
  • KTOR-9352 Authentication: Creating JWT verifier fails for JWK with kty=EC and alg=null
  • KTOR-9344 Flow invariant error happens after update to Ktor 3.4.0
  • KTOR-9362 testApplication: Race condition in timeout coroutine when response is streaming
  • KTOR-9274 Curl: Undefined symbol errors when linking on Linux since 3.4.0
  • KTOR-8782 NodeJS CIO: "Module 'os' could not be imported" error on resolving WORKING_DIRECTORY_PATH with es2015 target
  • KTOR-9348 String.decodeBase64String fails to decode when the input has no padding since 3.4.0
  • KTOR-9318 CIO engine rejects valid certificates with unsupported signature algorithms
  • KTOR-9331 Curl: Segfaults when working with WebSockets
  • KTOR-9334 Coroutines in route handlers are dispatched with Dispatchers.Unconfined since 3.2.0
  • KTOR-9339 StreamResetException is not propagated to the caller of StreamRequestBody.writeTo since 3.4.0
  • KTOR-9329 HTMX: "on" attributes extension not working
  • KTOR-9316 WasmJS bad get and set implementations for Uint8Array and ArrayLike
  • KTOR-9272 JSON schema inference does not recognize unsigned types
  • KTOR-9211 SendCountExceedException when request is sent twice with maxRetries = 0 since 3.3.2
  • KTOR-9285 RateLimit: Milliseconds in the Retry-After header are truncated
  • KTOR-7512 JWT: Docs for validate method claim that it's optional, but it isn't
  • KTOR-9269 Incorrect dependency declaration in swagger / openapi
  • KTOR-9372 Frame.Text.readText() causes infinite loop and 100% CPU on Kotlin/Native when WebSocket frame data is malformed or connection drops unexpectedly
Commits
  • c6c1a5c Release 3.4.1 (#5410)
  • 8c6ef88 KTOR-9353: Override toString for TailcardSelector and LocalPortRouteSelector ...
  • a6aed07 Follow-up KTOR-9333 Preserve inflater context (#5403)
  • a6bd1d3 KTOR-9344 Disable switching to engine dispatcher by default (#5408)
  • f557ef7 Add constraints for vulnerable dependencies (#5405)
  • a5b2eb6 KTOR-9352 Handle EC key type when JWK algorithm is null (#5387)
  • a971317 KTOR-9362 Catch ClosedWriteChannelException in the timeout coroutine to avoid...
  • a23c454 Add fix-bug Claude Code skill for automated bug fixing workflow (#5386)
  • 419f1fc GMTDate: zero-allocation timestamp conversion on JVM (#5380)
  • a07f463 Add workflow to close issues after 30 days of inactivity waiting for a reply ...
  • Additional commits viewable in compare view

Updates io.ktor:ktor-serialization-jackson from 3.4.0 to 3.4.1

Release notes

Sourced from io.ktor:ktor-serialization-jackson's releases.

3.4.1

Published 3 March 2026

Improvements

  • KTOR-9382 HttpProtocolVersion.parse: fast path for common versions
  • KTOR-9381 GMTDate: reduce allocations
  • KTOR-8971 Support "operationId" in Kdoc for OpenAPI spec. gen.
  • KTOR-9333 WebSockets: Infinite spin and potential OOM vulnerabilities in the Inflater.inflateFully method
  • KTOR-5616 Ktor always adds by default an Accept-Charset header
  • KTOR-9291 OpenAPI: handle atypical route functions
  • KTOR-9293 OpenAPI describe needs defaults
  • KTOR-9304 OpenAPI: Order of path parameters is not preserved in the spec
  • KTOR-9353 Routing: TailcardSelector missing toString(), which clutters the logs

Bugfixes

  • KTOR-9281 OpenApi code inference misses lambda argument bodies
  • KTOR-9273 OpenAPI static content path appears in resulting model
  • KTOR-9004 OpenAPI: No respective formats detected for serializable types like UUID or Instant
  • KTOR-9305 OpenAPI: "No mapping for symbol: VAR FOR_LOOP_VARIABLE" error with codeInferenceEnabled=true
  • KTOR-9279 OpenAPI: UnsupportedOperationException for a function with a reified type parameter codeInferenceEnabled = true
  • KTOR-9289 OpenAPI: Resource routes are missing inferred and comment-based documentation
  • KTOR-9330 OpenAPI: Cannot override kotlinx.serialization module
  • KTOR-9320 OpenAPI: jsonSchema() does not unwrap Kotlin value classes (inline classes)
  • KTOR-9352 Authentication: Creating JWT verifier fails for JWK with kty=EC and alg=null
  • KTOR-9344 Flow invariant error happens after update to Ktor 3.4.0
  • KTOR-9362 testApplication: Race condition in timeout coroutine when response is streaming
  • KTOR-9274 Curl: Undefined symbol errors when linking on Linux since 3.4.0
  • KTOR-8782 NodeJS CIO: "Module 'os' could not be imported" error on resolving WORKING_DIRECTORY_PATH with es2015 target
  • KTOR-9348 String.decodeBase64String fails to decode when the input has no padding since 3.4.0
  • KTOR-9318 CIO engine rejects valid certificates with unsupported signature algorithms
  • KTOR-9331 Curl: Segfaults when working with WebSockets
  • KTOR-9334 Coroutines in route handlers are dispatched with Dispatchers.Unconfined since 3.2.0
  • KTOR-9339 StreamResetException is not propagated to the caller of StreamRequestBody.writeTo since 3.4.0
  • KTOR-9329 HTMX: "on" attributes extension not working
  • KTOR-9316 WasmJS bad get and set implementations for Uint8Array and ArrayLike
  • KTOR-9272 JSON schema inference does not recognize unsigned types
  • KTOR-9211 SendCountExceedException when request is sent twice with maxRetries = 0 since 3.3.2
  • KTOR-9285 RateLimit: Milliseconds in the Retry-After header are truncated
  • KTOR-7512 JWT: Docs for validate method claim that it's optional, but it isn't
  • KTOR-9269 Incorrect dependency declaration in swagger / openapi
  • KTOR-9372 Frame.Text.readText() causes infinite loop and 100% CPU on Kotlin/Native when WebSocket frame data is malformed or connection drops unexpectedly
Changelog

Sourced from io.ktor:ktor-serialization-jackson's changelog.

3.4.1

Published 3 March 2026

Improvements

  • KTOR-9382 HttpProtocolVersion.parse: fast path for common versions
  • KTOR-9381 GMTDate: reduce allocations
  • KTOR-8971 Support "operationId" in Kdoc for OpenAPI spec. gen.
  • KTOR-9333 WebSockets: Infinite spin and potential OOM vulnerabilities in the Inflater.inflateFully method
  • KTOR-5616 Ktor always adds by default an Accept-Charset header
  • KTOR-9291 OpenAPI: handle atypical route functions
  • KTOR-9293 OpenAPI describe needs defaults
  • KTOR-9304 OpenAPI: Order of path parameters is not preserved in the spec
  • KTOR-9353 Routing: TailcardSelector missing toString(), which clutters the logs

Bugfixes

  • KTOR-9281 OpenApi code inference misses lambda argument bodies
  • KTOR-9273 OpenAPI static content path appears in resulting model
  • KTOR-9004 OpenAPI: No respective formats detected for serializable types like UUID or Instant
  • KTOR-9305 OpenAPI: "No mapping for symbol: VAR FOR_LOOP_VARIABLE" error with codeInferenceEnabled=true
  • KTOR-9279 OpenAPI: UnsupportedOperationException for a function with a reified type parameter codeInferenceEnabled = true
  • KTOR-9289 OpenAPI: Resource routes are missing inferred and comment-based documentation
  • KTOR-9330 OpenAPI: Cannot override kotlinx.serialization module
  • KTOR-9320 OpenAPI: jsonSchema() does not unwrap Kotlin value classes (inline classes)
  • KTOR-9352 Authentication: Creating JWT verifier fails for JWK with kty=EC and alg=null
  • KTOR-9344 Flow invariant error happens after update to Ktor 3.4.0
  • KTOR-9362 testApplication: Race condition in timeout coroutine when response is streaming
  • KTOR-9274 Curl: Undefined symbol errors when linking on Linux since 3.4.0
  • KTOR-8782 NodeJS CIO: "Module 'os' could not be imported" error on resolving WORKING_DIRECTORY_PATH with es2015 target
  • KTOR-9348 String.decodeBase64String fails to decode when the input has no padding since 3.4.0
  • KTOR-9318 CIO engine rejects valid certificates with unsupported signature algorithms
  • KTOR-9331 Curl: Segfaults when working with WebSockets
  • KTOR-9334 Coroutines in route handlers are dispatched with Dispatchers.Unconfined since 3.2.0
  • KTOR-9339 StreamResetException is not propagated to the caller of StreamRequestBody.writeTo since 3.4.0
  • KTOR-9329 HTMX: "on" attributes extension not working
  • KTOR-9316 WasmJS bad get and set implementations for Uint8Array and ArrayLike
  • KTOR-9272 JSON schema inference does not recognize unsigned types
  • KTOR-9211 SendCountExceedException when request is sent twice with maxRetries = 0 since 3.3.2
  • KTOR-9285 RateLimit: Milliseconds in the Retry-After header are truncated
  • KTOR-7512 JWT: Docs for validate method claim that it's optional, but it isn't
  • KTOR-9269 Incorrect dependency declaration in swagger / openapi
  • KTOR-9372 Frame.Text.readText() causes infinite loop and 100% CPU on Kotlin/Native when WebSocket frame data is malformed or connection drops unexpectedly
Commits
  • c6c1a5c Release 3.4.1 (#5410)
  • 8c6ef88 KTOR-9353: Override toString for TailcardSelector and LocalPortRouteSelector ...
  • a6aed07 Follow-up KTOR-9333 Preserve inflater context (#5403)
  • a6bd1d3 KTOR-9344 Disable switching to engine dispatcher by default (#5408)
  • f557ef7 Add constraints for vulnerable dependencies (#5405)
  • a5b2eb6 KTOR-9352 Handle EC key type when JWK algorithm is null (#5387)
  • a971317 KTOR-9362 Catch ClosedWriteChannelException in the timeout coroutine to avoid...
  • a23c454 Add fix-bug Claude Code skill for automated bug fixing workflow (#5386)
  • 419f1fc GMTDate: zero-allocation timestamp conversion on JVM (#5380)
  • a07f463 Add workflow to close issues after 30 days of inactivity waiting for a reply ...
  • Additional commits viewable in compare view

Updates io.ktor:ktor-server-openapi from 3.4.0 to 3.4.1

Release notes

Sourced from io.ktor:ktor-server-openapi's releases.

3.4.1

Published 3 March 2026

Improvements

  • KTOR-9382 HttpProtocolVersion.parse: fast path for common versions
  • KTOR-9381 GMTDate: reduce allocations
  • KTOR-8971 Support "operationId" in Kdoc for OpenAPI spec. gen.
  • KTOR-9333 WebSockets: Infinite spin and potential OOM vulnerabilities in the Inflater.inflateFully method
  • KTOR-5616 Ktor always adds by default an Accept-Charset header
  • KTOR-9291 OpenAPI: handle atypical route functions
  • KTOR-9293 OpenAPI describe needs defaults
  • KTOR-9304 OpenAPI: Order of path parameters is not preserved in the spec
  • KTOR-9353 Routing: TailcardSelector missing toString(), which clutters the logs

Bugfixes

  • KTOR-9281 OpenApi code inference misses lambda argument bodies
  • KTOR-9273 OpenAPI static content path appears in resulting model
  • KTOR-9004 OpenAPI: No respective formats detected for serializable types like UUID or Instant
  • KTOR-9305 OpenAPI: "No mapping for symbol: VAR FOR_LOOP_VARIABLE" error with codeInferenceEnabled=true
  • KTOR-9279 OpenAPI: UnsupportedOperationException for a function with a reified type parameter codeInferenceEnabled = true
  • KTOR-9289 OpenAPI: Resource routes are missing inferred and comment-based documentation
  • KTOR-9330 OpenAPI: Cannot override kotlinx.serialization module
  • KTOR-9320 OpenAPI: jsonSchema() does not unwrap Kotlin value classes (inline classes)
  • KTOR-9352 Authentication: Creating JWT verifier fails for JWK with kty=EC and alg=null
  • KTOR-9344 Flow invariant error happens after update to Ktor 3.4.0
  • KTOR-9362 testApplication: Race condition in timeout coroutine when response is streaming
  • KTOR-9274 Curl: Undefined symbol errors when linking on Linux since 3.4.0
  • KTOR-8782 NodeJS CIO: "Module 'os' could not be imported" error on resolving WORKING_DIRECTORY_PATH with es2015 target
  • KTOR-9348 String.decodeBase64String fails to decode when the input has no padding since 3.4.0
  • KTOR-9318 CIO engine rejects valid certificates with unsupported signature algorithms
  • KTOR-9331 Curl: Segfaults when working with WebSockets
  • KTOR-9334 Coroutines in route handlers are dispatched with Dispatchers.Unconfined since 3.2.0
  • KTOR-9339 StreamResetException is not propagated to the caller of StreamRequestBody.writeTo since 3.4.0
  • KTOR-9329 HTMX: "on" attributes extension not working
  • KTOR-9316 WasmJS bad get and set implementations for Uint8Array and ArrayLike
  • KTOR-9272 JSON schema inference does not recognize unsigned types
  • KTOR-9211 SendCountExceedException when request is sent twice with maxRetries = 0 since 3.3.2
  • KTOR-9285 RateLimit: Milliseconds in the Retry-After header are truncated
  • KTOR-7512 JWT: Docs for validate method claim that it's optional, but it isn't
  • KTOR-9269 Incorrect dependency declaration in swagger / openapi
  • KTOR-9372 Frame.Text.readText() causes infinite loop and 100% CPU on Kotlin/Native when WebSocket frame data is malformed or connection drops unexpectedly
Changelog

Sourced from io.ktor:ktor-server-openapi's changelog.

3.4.1

Published 3 March 2026

Improvements

  • KTOR-9382 HttpProtocolVersion.parse: fast path for common versions
  • KTOR-9381 GMTDate: reduce allocations
  • KTOR-8971 Support "operationId" in Kdoc for OpenAPI spec. gen.
  • KTOR-9333 WebSockets: Infinite spin and potential OOM vulnerabilities in the Inflater.inflateFully method
  • KTOR-5616 Ktor always adds by default an Accept-Charset header
  • KTOR-9291 OpenAPI: handle atypical route functions
  • KTOR-9293 OpenAPI describe needs defaults
  • KTOR-9304 OpenAPI: Order of path parameters is not preserved in the spec
  • KTOR-9353 Routing: TailcardSelector missing toString(), which clutters the logs

Bugfixes

  • KTOR-9281 OpenApi code inference misses lambda argument bodies

@dependabot
deps(deps): bump ktor from 3.4.0 to 3.4.1
2be9025 
Bumps `ktor` from 3.4.0 to 3.4.1.

Updates `io.ktor:ktor-server-core` from 3.4.0 to 3.4.1
- [Release notes](https://github.com/ktorio/ktor/releases)
- [Changelog](https://github.com/ktorio/ktor/blob/main/CHANGELOG.md)
- [Commits](ktorio/ktor@3.4.0...3.4.1)

Updates `io.ktor:ktor-server-netty` from 3.4.0 to 3.4.1
- [Release notes](https://github.com/ktorio/ktor/releases)
- [Changelog](https://github.com/ktorio/ktor/blob/main/CHANGELOG.md)
- [Commits](ktorio/ktor@3.4.0...3.4.1)

Updates `io.ktor:ktor-server-content-negotiation` from 3.4.0 to 3.4.1
- [Release notes](https://github.com/ktorio/ktor/releases)
- [Changelog](https://github.com/ktorio/ktor/blob/main/CHANGELOG.md)
- [Commits](ktorio/ktor@3.4.0...3.4.1)

Updates `io.ktor:ktor-serialization-jackson` from 3.4.0 to 3.4.1
- [Release notes](https://github.com/ktorio/ktor/releases)
- [Changelog](https://github.com/ktorio/ktor/blob/main/CHANGELOG.md)
- [Commits](ktorio/ktor@3.4.0...3.4.1)

Updates `io.ktor:ktor-server-openapi` from 3.4.0 to 3.4.1
- [Release notes](https://github.com/ktorio/ktor/releases)
- [Changelog](https://github.com/ktorio/ktor/blob/main/CHANGELOG.md)
- [Commits](ktorio/ktor@3.4.0...3.4.1)

Updates `io.ktor:ktor-server-swagger` from 3.4.0 to 3.4.1
- [Release notes](https://github.com/ktorio/ktor/releases)
- [Changelog](https://github.com/ktorio/ktor/blob/main/CHANGELOG.md)
- [Commits](ktorio/ktor@3.4.0...3.4.1)

Updates `io.ktor:ktor-server-routing-openapi` from 3.4.0 to 3.4.1
- [Release notes](https://github.com/ktorio/ktor/releases)
- [Changelog](https://github.com/ktorio/ktor/blob/main/CHANGELOG.md)
- [Commits](ktorio/ktor@3.4.0...3.4.1)

Updates `io.ktor.plugin` from 3.4.0 to 3.4.1

---
updated-dependencies:
- dependency-name: io.ktor:ktor-server-core
  dependency-version: 3.4.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: io.ktor:ktor-server-netty
  dependency-version: 3.4.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: io.ktor:ktor-server-content-negotiation
  dependency-version: 3.4.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: io.ktor:ktor-serialization-jackson
  dependency-version: 3.4.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: io.ktor:ktor-server-openapi
  dependency-version: 3.4.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: io.ktor:ktor-server-swagger
  dependency-version: 3.4.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: io.ktor:ktor-server-routing-openapi
  dependency-version: 3.4.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: io.ktor.plugin
  dependency-version: 3.4.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@claude
Copy link
Copy Markdown

claude bot commented Mar 23, 2026

Review: Ktor 3.4.0 → 3.4.1

This is a straightforward patch bump with no API changes. The diff is a single line in gradle/libs.versions.toml.

Highlights from the 3.4.1 release worth noting:

  • KTOR-9333 — WebSockets: Infinite spin and potential OOM in Inflater.inflateFully. Relevant if the MCP server uses WebSocket connections.
  • KTOR-9344 — Flow invariant error introduced in 3.4.0 (marked Impactful). Good to pick up quickly.
  • KTOR-9334 — Coroutines in route handlers dispatched with Dispatchers.Unconfined since 3.2.0. This is a correctness fix for route handler coroutine behavior.
  • KTOR-9339 — StreamResetException not propagated to caller of StreamRequestBody.writeTo since 3.4.0 (regression fix).
  • KTOR-9318 — CIO engine rejects valid certificates with unsupported signature algorithms.

Assessment: Safe to merge. This is a patch release that fixes several 3.4.0 regressions. No breaking changes. The OOM/spin fix in WebSockets and the dispatcher correctness fix (KTOR-9334) are particularly good to pick up.

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Mar 23, 2026

Code Coverage

Total Project Coverage 67.52% ❌

@rustyrazorblade rustyrazorblade merged commit c0cd47f into main Mar 26, 2026
3 checks passed
@rustyrazorblade rustyrazorblade deleted the dependabot/gradle/ktor-3.4.1 branch March 26, 2026 02:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies gradle

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@rustyrazorblade