Update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Age	Confidence
gradle (source)		patch	8.14.4 → 8.14.5
com.squareup.okhttp3:okhttp (source)	dependencies	minor	5.3.2 → 5.5.0
org.jetbrains.intellij.platform	plugin	minor	2.11.0 → 2.18.1
com.gradle:develocity-gradle-plugin (source)	dependencies	minor	4.3.1 → 4.5.0
com.autonomousapps:dependency-analysis-gradle-plugin	dependencies	minor	3.5.1 → 3.19.1
com.vanniktech:gradle-maven-publish-plugin	dependencies	minor	0.35.0 → 0.37.0
com.ncorti.ktfmt.gradle	plugin	minor	0.25.0 → 0.27.0
com.ncorti.ktfmt.gradle:plugin	dependencies	minor	0.25.0 → 0.27.0
com.fasterxml.woodstox:woodstox-core	dependencies	minor	7.1.1 → 7.2.2
com.squareup.wire:wire-runtime	dependencies	patch	5.5.0 → 5.5.1
com.google.truth:truth	dependencies	patch	1.4.4 → 1.4.5
com.fueledbycaffeine.spotlight:buildscript-utils	dependencies	minor	1.6.8 → 1.7.0
com.fueledbycaffeine.spotlight:spotlight-gradle-plugin	dependencies	minor	1.6.8 → 1.7.0
com.squareup.okio:okio	dependencies	minor	3.16.4 → 3.18.1
com.squareup.okhttp3:logging-interceptor (source)	dependencies	minor	5.3.2 → 5.5.0
androidx.lint:lint-gradle (source)	dependencies	patch	1.0.0-alpha05 → 1.0.0
org.jetbrains.kotlinx:kotlinx-serialization-json	dependencies	minor	1.10.0 → 1.11.0
org.jetbrains.kotlinx:kotlinx-datetime	dependencies	minor	0.7.1 → 0.8.0
com.autonomousapps.testkit	plugin	minor	0.17 → 0.20
org.jetbrains.kotlin.plugin.serialization	plugin	minor	2.2.21 → 2.4.10
org.jetbrains.kotlin.jvm	plugin	minor	2.2.21 → 2.4.10
io.insert-koin:koin-core (source)	dependencies	minor	4.1.1 → 4.2.2
com.fueledbycaffeine.spotlight	plugin	minor	1.6.6 → 1.7.0
org.eclipse.jgit:org.eclipse.jgit	dependencies	minor	7.5.0.202512021534-r → 7.7.1.202607240634-r
com.autonomousapps:gradle-testkit-truth	dependencies	minor	1.6.1 → 1.7.1
com.autonomousapps:gradle-testkit-plugin	dependencies	minor	0.17 → 0.20
com.gradleup.shadow	plugin	minor	9.3.1 → 9.6.1
com.autonomousapps:gradle-testkit-support	dependencies	minor	0.22 → 0.28

---

Release Notes

gradle/gradle (gradle)

v8.14.5: 8.14.5

Compare Source

The Gradle team is excited to announce Gradle 8.14.5.

Here are the highlights of this release:

• Java 24 support
• GraalVM Native Image toolchain selection
• Enhancements to test reporting
• Build Authoring improvements

Read the Release Notes

We would like to thank the following community members for their contributions to this release of Gradle:
Aurimas,
Ben Bader,
Björn Kautler,
chandre92,
Daniel Hammer,
Danish Nawab,
Florian Dreier,
Ivy Chen,
Jendrik Johannes,
jimmy1995-gu,
Madalin Valceleanu,
Na Minhyeok.

Upgrade instructions

Switch your build to use Gradle 8.14.5 by updating your wrapper:

./gradlew wrapper --gradle-version=8.14.5 && ./gradlew wrapper

See the Gradle 8.x upgrade guide to learn about deprecations, breaking changes and other considerations when upgrading.

For Java, Groovy, Kotlin and Android compatibility, see the full compatibility notes.

Reporting problems

If you find a problem with this release, please file a bug on GitHub Issues adhering to our issue guidelines.
If you're not sure you're encountering a bug, please use the forum.

We hope you will build happiness with Gradle, and we look forward to your feedback via Twitter or on GitHub.

lysine-dev/okhttp (com.squareup.okhttp3:okhttp)

v5.5.0

2026-08-16

This release introduces opt-in support for [Encrypted Client Hello (ECH)]. This new feature
improves user privacy by encrypting domain names in transit. With regular TLS, your coffee shop’s
Wi-Fi router can see that you’re visiting wikipedia.com, but it cannot see which page you’re
looking at. With ECH, the router observes only the IP address. This additional privacy is most
effective on sites hosted by big CDNs because the IP address doesn’t imply a particular website.

This requires ECH support in the platform’s TLS stack. Today this is only Android 17 (API 37,
released June 2026). When other TLS stacks add ECH support, we'll integrate them.

ECH took a lot of work to implement because the encryption keys are published over DNS in the
[HTTPS resource record], and we needed to write new code to fetch these records. This release
includes a major update to OkHttp’s DNS API: it now supports multiple resource record types (not
just IP addresses!), asynchronous streaming results, and in-memory caching.

To opt in, you can use DnsOverHttps:

// DnsOverHttps itself uses OkHttpClient. Build both clients upon the
// same bootstrap client so they share a connection pool and dispatcher.
val bootstrapClient = OkHttpClient()

// This sample uses Cloudflare's 1.1.1.1 DnsOverHttps service.
val client = bootstrapClient.newBuilder()
  .dns(DnsOverHttps.Builder()
    .client(bootstrapClient)
    .url("https://1.1.1.1/dns-query".toHttpUrl())
    .build())
  .build()

You could also opt in with our new AndroidDns API. Unfortunately, the privacy benefits of ECH are
deficient because its DNS queries are not encrypted by default.

// AndroidDns fetches the HTTPS DNS resource records necessary for ECH.
val client = OkHttpClient.Builder()
  .dns(AndroidDns())
  .build()

• New: OkHttp artifacts is now signed with our [new signing key]. This project and three sibling
  projects ([Retrofit], [Okio], and [SQLDelight]) recently joined [the Commonhaus Foundation].
• Fix: MockWebServer’s @StartStop annotation now supports @Nested JUnit 5 tests.
• Fix: Our default TLS hostname verifier now reject hosts that fail IP canonicalization.
• Fix: Closing a multipart part's sink no longer closes the entire request body.
• Fix: Flush HTTP/1 request bodies before detaching the timeout. We had a bug where timeouts
  weren’t applied correctly.
• Fix: Follow [RFC 1008]'s requirements for HTTP QUERY redirects.
• Fix: Fall back to no proxy when the system proxy selector throws. Previously this would cause
  the HTTP call to crash.
• Upgrade: [Okio 3.18.1][okio_3_18_1].

v5.4.0

2026-06-08

• New: Add superpowers to interceptors. Interceptors can now override anything settable on
  OkHttpClient.Builder, such as the cache, connection pool, socket factory, and DNS. We expect
  this will allow most users to use interceptors everywhere, insted of mixing and matching
  interceptors with custom Call.Factory wrappers.
• Fix: Limit each HTTP/2 response to 256 KiB of total headers.
• Upgrade: [kotlinx.coroutines 1.11.0][coroutines_1_11_0]. This is used by the optional
  okhttp-coroutines artifact.
• Upgrade: [GraalVM 25.0.3][graalvm_25].
• Upgrade: [Okio 3.17.0][okio_3_17_0].

autonomousapps/dependency-analysis-android-gradle-plugin (com.autonomousapps:dependency-analysis-gradle-plugin)

v3.19.1

• [fix]: an 'analyzable class file' should have non-zero length.

v3.19.0

• [feat]: ':printDuplicateDependencies' will now store the console output in a file on disk.
• [fix]: incorrect Android-variant configuration advice.
• [fix]: merge binary classes from all jar artifacts when building map.
• [fix]: track component identifiers as input to tasks that write them to output.
• [fix]: handle mixed source sets better.
• [fix]: make ArtifactsReportTask cacheable again.
• [fix]: simplify kotlin-metadata-jvm runtime handling.
• [refactor]: use non-deprecated API in KMP analysis.
• [refactor]: add ExpensiveJar type to hold BinaryClasses, removing them from ExplodedJar.
• [test]: add test to ensure cache correctness.
• [maintenance]: build with (and test against) Gradle 9.7.1 and KGP 2.4.0.
• [maintenance]: update (and test against) AGP 9.3.1.
• [security]: (GH actions) add 'persist-credentials: false' and disable all permissions by default.
• [docs]: update issue templates and add a PR template.
• [docs]: add GH workflow for creating GH releases.
• [chore]: do not skip metadata version check.
• [chore]: enable feature preview: NO_IMPLICIT_LOOKUP_IN_PARENT_PROJECTS.
• [chore]: update dependency org.apache.groovy:groovy to v4.0.33.
• [chore]: update dependency com.android.tools.metalava:metalava to v1.0.0-alpha15.
• [chore]: update dependency com.github.ben-manes.caffeine:caffeine to v3.2.4.
• [chore]: update dependency org.jspecify:jspecify to v1.0.1.
• [chore]: update dependency org.junit:junit-bom to v5.14.4.
• [chore]: update Develocity to latest.
• [chore]: configure Renovate.
• [chore]: add 'setup-testlens' action to CI workflow.

v3.18.0

• [feat]: isolate usage of "kotlin-metadata-jvm" to workers and downgrade Kotlin version used by the plugin.
• [feat]: allow to exclude ABI by source path.
• [fix]: GraphViewTask's inputs are inputs, not internal details.
• [fix]: make GraphViewTask sensitive to new transitive project edges.
• [fix]: disable caching for ArtifactsReportTask.
• [fix]: Don't fail IDEA sync when registering InMemoryCache with a task.
• [chore]: update kotlin-editor-relocated to 0.25.0.
• [chore]: update gradle-script-grammar to 0.7.
• [chore]: use Gradle 9.6.1.
• [docs]: add 'troubleshooting' section to README with discussion of the "kotlin-metadata-jvm" issue.
• [maintenance]: resolve Gradle deprecations.
• [test]: the usual gradle flags should be set for all tests (in particular, org.gradle.caching=true).

v3.17.0

• [feat]: support KMP with 'fixDependencies' (RewriteTask) in Kotlin DSL only.
• [feat]: add DSL option for binary-compatibility check. It now defaults to 'false'. This is a breaking behavioral
  change.
• [fix]: close leaked ZipFile objects.
• [fix]: use Iterator.remove() to remove changes in Android project analysis.
• [performance]: reduce memory usage when not opting-in to the binary-compatibility check.
• [refactor]: limit use of T.toJson(). Prefer bufferedWriteJson().

v3.16.1

• [fix]: stop checking for missing runtime exceptions.
• [fix]: don't advise moving dependency from commonMainApi to jvmMainApi.
• [fix]: use Iterator.remove() for safe modification.
• [perf]: compress synthetic-project.json to save disk space.
• [chore]: update kotlin-editor-relocated to latest.
• [chore]: update simple grammar ('antlr-shadowed') to latest.
• [chore]: build with Gradle 9.6.0, and test against it
• [refactor]: split StandardTransform into Android/JVM/KMP-specific classes.

v3.16.0

• [feat]: only emit 'Fixing dependencies for...' if the build script is being rewritten.
• [fix]: test against AGP 9.2.1 and update AGP_MAX to 9.2.1.
• [fix]: make InMemoryCache compatible with isolated projects.
• [fix]: escape Kotlin reserved keywords when using project accessors.
• [fix]: improve handling of Android product flavors.
• [fix]: improve handling of Android build types.
• [chore]: update kotlin-editor-relocated to latest.

v3.15.0

• [feat]: support AGP 9.2.0.
• [fix]: don't report Android R classes as classpath duplicates.
• [fix]: track multiple package names from libs that provide type aliases, and enhance default kotlin-lib bundle.
• [fix]: update metadata of :aggregatePublicTypesTask to move group to description.
• [fix]: simple grammar supports another kind of file-level annotation. (Updated com.autonomousapps:antlr to latest.)

v3.14.1

• [fix]: resolve performance issue with computeTypeUsage.
• [fix]: JarExploder should ignore some MRJar content.

v3.14.0

• [feat]: new ':publicTypeUsage' task.
• [fix]: AndroidScore should ignore class files when testing if a project has source splits.

v3.13.0

• [feat]: new computeTypeUsage<variant> task generates usage report.
• [fix]: when computing actual usages, actually look at the runtime graph.
• [refactor]: use Graphs wrapper instead of Guava directly.

v3.12.2

• [fix]: The new "exceptions are special" (in v3.12.0) handling was over-eager and flagging things that only referenced
  exceptions. We only want to flag things that provide the exception types.
• [fix]: MutableSet<Usage>.simplify(visibility, bucket) in StandardTransform wasn't properly handling the case when
  a usage was visible on both compile and runtime classpaths. In such a case, we can filter out all usages.
• [fix]: reason output said "implies implementation" when it should have been "implies runtimeOnly" in the android lint
  jar case.

v3.12.1

• [fix]: don't suggest non-existent Android unit test variant in advice.

v3.12.0

• [feat]: exceptions are special. Exceptions get verified early by the JVM and so if a dependency is missing an
  exception's type from the runtime classpath, that can cause failures in the consumer at runtime.

v3.11.0

• [fix]: when following a bundle rule, don't drop api dependencies.

v3.10.0

• [feat]: Gradle plugin markers are the preferred way to depend on a plugin.
• [feat]: Gradle plugin markers are part of an implicit bundle.
• [fix]: handle dependencies blocks that have a single line.
• [docs]: add 'partial analysis' section to readme.

v3.9.0

• (Reverted) Compiled against Kotlin 2.3.20. Compiling against Kotlin 2.2.21 again, with language level 2.2.

v3.8.0

• [feat]: record lambda in binaryClassAccesses.
• [feat]: support analysis of a Gradle version catalog dependency.
• [feat]: remove unused 'file' property.
• Compiled against Kotlin 2.3.20.

v3.7.0

• [feat]: Expose useParenthesesForGroovy configuration for Groovy DSL syntax control.
• [fix]: fix regex for excluding all *Generated annotations.
• [fix]: don't attempt to suggest upgrading an undeclared 'parent' dependency of a KMP dependency.
• [fix]: the 'androidMain' source set is special.
• [chore]: Compiled against Kotlin 2.2 and Gradle 9.4.1.
• [chore]: add Code of Conduct.

v3.6.1

• [Fix]: use compilation.disambiguatedName for crafting the task suffix.

v3.6.0

• [Breaking]: min version of Android Gradle Plugin (AGP) is now 8.10.0.
• [Feat]: support KMP projects with JVM targets.
• [Feat]: support KMP projects with Android targets.
• [Feat]: update console report to be more idiomatic for KMP.
• [Feat]: implement ABI inclusions filter.
• [Feat]: add lifecycle resolveExternalDependencies task.
• [Fix]: improve Class.forName handling.
• [Fix]: remove dependency to javax.inject.
• [Fix]: potential resource leak in JarExploder.
• [Fix]: duplicate class detection for annotations.
• [Fix]: use latest-kotlin editor.
• [Refactor]: move two public types to an internal package to exclude from published api, and exclude the
  com.autonomousapps.model.internal package from the published api.
• [Refactor]: moved a lot of task-registration code into AbstractDependencyAnalyzer.
• [Docs]: add link to maven-hijack blog post.

vanniktech/gradle-maven-publish-plugin (com.vanniktech:gradle-maven-publish-plugin)

v0.37.0

Compare Source

• When publishing to Maven Central, redundant checksum files are now excluded by default: checksums of .asc
  signature files (gradle/gradle#20232) and the sha256/sha512
  checksums, which are never read by Gradle or Maven Central. The published checksums can be configured through
  checksums(...) in the DSL or the mavenCentralChecksums Gradle property (default md5,sha1). Signature checksum
  exclusion can be controlled through excludeSignatureChecksums() or the mavenCentralExcludeSignatureChecksums
  Gradle property.
• Maven Central deployment id is being logged after upload.

Minimum supported versions

• JDK 17
• Gradle 9.0.0
• Android Gradle Plugin 8.13.0
• Kotlin Gradle Plugin 2.2.0

Compatibility tested up to

• JDK 26
• Gradle 9.6.0
• Gradle 9.7.0-milestone-1
• Android Gradle Plugin 9.2.1
• Android Gradle Plugin 9.3.0-rc01
• Android Gradle Plugin 9.4.0-alpha01
• Kotlin Gradle Plugin 2.4.0

v0.36.0

Compare Source

BREAKING

• Updated minimum supported JDK, Gradle, Android Gradle Plugin and Kotlin versions.
• Removed support for Dokka v1, it's now required to use Dokka in v2 mode.
• Mark DirectorySignatureType internal.

Behavior changes

• validateDeployment now has the DeploymentValidation enum as type instead of being a boolean. The default
  is now to just wait for the VALIDATED state. The previous behavior can be achieved by setting it to PUBLISHED.
  NONE can be used for disabling the validation completely.
• When calling configure(...) manually to configure what to publish and not passing javadocJar explicity,
  the plugin now defaults to publishing an empty javadoc jar.

Features

• Android projects now support using Dokka for javadoc creation, this will happen automatically
  when using the default options and the Dokka plugin is applied to the project.
• Added consistent JavadocJar and SourcesJar options to configureBasedOnAppliedPlugins and to all
  applicable project types that can be passed to configure. The previous Boolean based versions have
  been deprecated.
• When enabling Maven Central publishing through the DSL, the mavenCentralDeploymentValidation and
  mavenCentralAutomaticPublishing are used for the default values of the 2 parameters when they are not passed
  explicitly. This allows to more easily override them in certain environments.
• When isolated projects is enabled the module/project specific gradle.properties files are now considered in
  the same way they are when isolated projects is disabled.

Improvements

• Better error message when Maven Central credentials are missing.

Minimum supported versions

• JDK 17
• Gradle 9.0.0
• Android Gradle Plugin 8.13.0
• Kotlin Gradle Plugin 2.2.0

Compatibility tested up to

• JDK 25
• Gradle 9.3.0
• Gradle 9.4.0-milestone-4
• Android Gradle Plugin 8.13.2
• Android Gradle Plugin 9.0.0
• Android Gradle Plugin 9.1.0-alpha05
• Kotlin Gradle Plugin 2.3.0
• Kotlin Gradle Plugin 2.3.20-Beta1

square/wire (com.squareup.wire:wire-runtime)

v5.5.1

Compare Source

2026-03-05

Kotlin

• Add option to avoid making immutable copies for Kotlin generations (#​3513 by [Jeff Gulbronson][JGulbronson])
  If set to false, Wire will not use immutable copies for repeated or map fields.

wire {
  kotlin {
    makeImmutableCopies = false
  }
}

google/truth (com.google.truth:truth)

v1.4.5: 1.4.5

• Changed assertions like assertThat(nullMap).isEmpty() to fail with a useful failure message instead of throwing NullPointerException (and similarly for other "bogus" values, such as negative sizes). (da5d6e9)
• Made Kotlin's isInstanceOf(Int::class.java) (and Java's isInstanceOf(int.class)) a valid way to check for Int/Integer instances. (974ef19)
• Improved isWithin to pretty-print numbers in its failure messages. (de78553, 07318c2)
• Improved some assertions that print class names to print simpler names (e.g., Integer instead of java.lang.Integer). (0ba72d6)
• Changed ExpectFailure to never generate "value of" lines based on bytecode. This slightly simplifies writing new tests with ExpectFailure and prevents future behavior changes in some ExpectFailure tests that already exist. However, it may also require changes to other existing ExpectFailure tests to remove or change any assertions about the "value of" line. (3caa0e8)
• Our Android minSdkVersion is now 23 (Marshmallow). This follows the minimum of Google's foundational Android libraries, and we expect it to have no practical impact on users. (c85c75c)
• Changed our GWT/J2CL artifact to omit usages of @NullMarked. This was making all our types non-null in those environments, since we don't yet use @Nullable in the GWT/J2CL artifact. (6392d37)

joshfriend/spotlight (com.fueledbycaffeine.spotlight:buildscript-utils)

v1.7.0

Gradle Plugin

• Add taskInvocationRules to spotlight-rules.json for including projects (or all projects) when specific tasks are invoked

v1.6.12

Gradle Plugin

• Declare support for configuration cache
• Don't flag include statements that are commented-out in :checkAllProjectsList

IDE plugin

• Don't show IDE banners when Spotlight plugin isn't applied

v1.6.11

1.6.11

v1.6.10

1.6.10

v1.6.9

IDE plugin

• Add "Replace Spotlight with Selection" action (Cmd+Shift+I) to replace the entire module selection with the currently selected project(s)
• Add notifications when a project is added/removed from Spotlight
• Actions are now dumb-aware
• Fix error returning null widget presentation
• Bump minimum and target IntelliJ version to 252

lysine-dev/okio (com.squareup.okio:okio)

v3.18.1

2026-07-28

• Fix: Restore binary-compatibility with Okio 3.17.x for Kotlin/Native users. When we introduced
  the new base64() function, we inadvertently changed the binary signature! Ugh! This is now
  fixed and we've automated binary-compatibility checking for Kotlin/Native going forward.

v3.18.0

2026-07-21

• Fix: Use wide character APIs to better support of non-UTF-8 filesystems on Windows.
• Fix: Don't crash in AssetFileSystem.exists() when the underlying storage throws a
  FileNotFoundException.
• Fix: Load WASI paths relative to their preopen. The platform behavior recently changed in
  NodeJS, causing our WasiFileSystem to be unable to access files!
• New: Optionally ignore whitespace when decoding hexadecimal.
• New: Optionally omit padding when encoding Base64.
• New: BufferedSource.readUInt(), BufferedSink.writeUInt(), and similar functions for UByte,
  UShort and ULong. Also add support for unsigned and little-endian.
• New: BufferedSink.utf8Appendable(). Use this to adapt an Okio sink to an Appendable.
• New: Source.limit() returns a wrapped source with a strict limit on how many bytes are
  returned.
• New: ByteString.equals(other, constantTime) for subtle defense against timing attacks.

v3.17.0

2026-03-11

• New: Adjust down the Kotlin stdlib dependency to [Kotlin 2.1.21][kotlin_2_1_21]. Okio is built
  with an up-to-date Kotlin compiler (2.2.21), but depends on an older kotlin-stdlib. We're doing
  this so you can update Okio and Kotlin independently.

• Fix: Return the correct timestamp in FileMetadata.createdAtMillis on Kotlin/Native on UNIX
  platforms. We were incorrectly using the POSIX ctime (change time) instead of the
  birthtime. With this fix Okio now prefers statx() over stat() on native platforms. This
  API first appeared in Linux in 4.11 (2017) and Android in API 30 (2020).

Kotlin/kotlinx.serialization (org.jetbrains.kotlinx:kotlinx-serialization-json)

v1.11.0

==================

This release is based on Kotlin 2.3.20 and provides new Json exceptions API and some bugfixes and improvements.

Expose Json exceptions structure

To make working with exceptions easier and providing proper error codes in e.g., REST APIs,
classes JsonException, JsonDecodingException, and JsonEncodingException are now public.
They have relevant public properties, such as shortMessage, path, offset, and others.
This API is currently experimental, and we're going to improve it further in the subsequent releases.
See the linked issues for the details: #​1930, #​1877.

Ability to hide user input from exception messages for security/privacy reasons.

Historically, exception messages in kotlinx.serialization often included the input Json itself for debuggability reason.
Such behavior may pose additional challenges for logging, analytics, and other systems, since
a system is not always allowed to store user data due to privacy/security reasons, which imposes additional sanitation logic.
To address this issue, a new property exceptionsWithDebugInfo is added to JsonConfiguration.
Disable it to hide user input from exception messages.
IMPORTANT: This behavior will be enabled by default when this property becomes stable.
See #​2590 for more details.

Bugfixes and improvements

• CBOR: Relax value range check when decoding numbers (#​3167)
• Use a specialized writeDecimalLong method for IO stream integrations in Json (#​3152)

Kotlin/kotlinx-datetime (org.jetbrains.kotlinx:kotlinx-datetime)

v0.8.0

Breaking changes:

• Deprecate TimeZone serialization (#​576).

Additions:

• Add orNull functions for non-throwing construction of datetime entities (#​68).
• Add parseOrNull extension functions for non-throwing attempts at parsing (#​508).
• Introduce LocalIsoWeekDate for representing ISO week dates (#​603).
• Introduce functions for finding the next or previous date with the given day-of-week (#​129).

Tweaks and fixes:

• Fix bugs in Instant.until and Instant.periodUntil (#​534).
• Always output seconds in the DateTimeComponents.Formats.RFC_1123 format (#​608).
• On Kotlin/Native for Windows, whenever DST transitions are turned off by the user, the current system time zone is now fixed-offset (#​575).

Changelog relative to version 0.8.0-rc02

No changes, only the version is increased.

InsertKoinIO/koin (io.insert-koin:koin-core)

v4.2.2: Koin 4.2.2

Compare Source

Maintenance release for the 4.2.x line — resolver regression fixes from the 4.2.0 CoreResolverV2 rewrite, ViewModel/scope fixes, a Ktor request-scope fix, plus new tvOS support and an R8/ProGuard guide.

Anyone hitting resolver issues on 4.2.0/4.2.1 should upgrade to 4.2.2.

Bug Fixes

• Stacked params no longer shadow qualified dependencies (#​2370, #​2408) — A value passed via parametersOf could be returned for a get(named(...)) request of the same type, shadowing the qualified definition. Qualified lookups are now registry-only and never read the parameter stack — parameters carry no qualifier, so they can't satisfy a qualified request.

• Root factory no longer resolves its scoped dependencies from _root_ (#​2379) — When a non-single factory defined in the root scope was resolved from a child scope, CoreResolverV2 resolved its scoped dependencies against _root_ instead of the requesting scope. Linked-scope resolution now runs the factory against the requesting scope (single instances keep their root-bound semantics, preserving #​2325).

• viewModelScopeFactory scope is linked to its parent (#​2299) — A ViewModel scope created via viewModelScopeFactory() was not linked to the originating scope, so dependencies declared in the parent couldn't be resolved. The created scope is now linked to its parent (except when the parent is root).

• Tolerate non-String environment properties (#​2348) — Loading environment/system properties whose values aren't String threw ClassCastException due to an unchecked map cast. Non-String values are now preserved as Any and only String keys are required.

• Unique Ktor request-scope ids under concurrency (#​2410) — Concurrent requests could collide on request-scope ids. Ids are now generated from a monotonic counter seeded once at startup. Thanks @​lfavreli-betclic!

• Actionable errors for SavedStateHandle / viewModelScope { } (#​2044, #​2417) — Resolving SavedStateHandle without the proper extras, or using viewModelScope { } without the viewModelScopeFactory() option, now produces a clear, actionable error message instead of an opaque failure.

Added

• tvOS targets for koin-core-viewmodel (#​2426) — koin-core-viewmodel now publishes tvosArm64, tvosX64, and tvosSimulatorArm64, unblocking ViewModel usage on tvOS.

• Consumer R8/ProGuard rules + guide — Android and ViewModel artifacts now ship consumer R8/ProGuard rules in their AARs, and a new R8 / ProGuard guide documents keep rules for minified builds.

Improvements

• O(1) secondary-type registration in bind() / binds() — bind/binds now append secondary types in O(1) instead of reallocating the type list per binding, removing quadratic cost when a definition declares many bindings. No user-visible behavior change.

Documentation

• Navigation 3 typed entryProvider (#​2336) — Added guidance on using Koin with the typed entryProvider in the Navigation 3 reference.

Contributors

Thanks to the following contributors for this release:

• @​arnaudgiuliani (Arnaud Giuliani)
• @​lfavreli-betclic (Loïc Favrelière) — unique Ktor request-scope ids under concurrency (#​2432)

v4.2.1: Koin 4.2.1

Compare Source

Support for Compile Safety with Koin Compiler 1.0.0-RC1

• Koin Compiler Plugin 1.0.0-RC1 - https://github.com/InsertKoinIO/koin-compiler-plugin/releases/tag/1.0.0-RC1

Bug Fixes

• Fix stacked-params lookup on linked scopes (#​2387) — The 4.2.0 resolver rewrite (CoreResolverV2) walked linked scopes but dropped the per-parent stacked-parameters check that 4.1.x performed via recursion. This broke patterns where AndroidParametersHolder is stacked on the factory scope by KoinViewModelFactory and SavedStateHandle is then resolved from a child ViewModel scope. Linked-scope resolution now also checks stacked params on each parent scope.

• Restore ABI compatibility for runOnKoinStarted (#​2391) — The 4.2.0 release inadvertently broke binary compatibility for runOnKoinStarted on JVM. Fixed by restoring the original JVM class name via @JvmName/@JvmMultifileClass annotations.

• Fix scope _closed concurrency issue (#​2389) — The Scope._closed flag was not volatile, which could cause stale reads under concurrent access.

Improvements

• Improved Scope resolution error messages — CoreResolverV2 now provides clearer error messages when scope resolution fails, making it easier to diagnose misconfigured scopes.

• Added apiCheck to CI — Binary compatibility validation (kotlinx.binary-compatibility-validator) now runs on every PR to prevent future ABI breaks.

Documentation

• parametersOf type-collision warning (#​2328) — Added a caution note explaining that when a value passed via parametersOf has the same type as the requested definition, Koin returns the value directly and skips the factory block. Suggests using a wrapper type as a workaround.

Contributors

Thanks to the following contributors for this release:

• @​arnaudgiuliani (Arnaud Giuliani)
• @​inemtsev (Ilya Nemtsev) — fix for scope closed concurrency issue (#​2389)

v4.2.0

Compare Source

Kotlin 2.3.20

New Features

• Ktor 3.4 DI Bridge — Full integration with Ktor's new DI system (ktor-server-di), bridging Ktor ↔ Koin dependency injection both ways
• Dagger Bridge (koin-dagger-bridge) — New module to help inject Koin components from Dagger side
• AndroidX Navigation 3 support — Entry point provider with metadata parameter passing (animations, etc.), generic EntryProvider, and navigation scopes
• Navigation Scope for Compose Nav 2 — Added scoped navigation support for Compose Navigation 2
• Lazy Modules — Parallel loading at startup for improved performance, with benchmarks
• strictOverride option — New definition option to override explicitly
• koinActivityInject — Helper to retrieve dependencies against Activity scope
• Koin Compiler Stubs — Added stubs for KoinApplication.modules() functions
• KoinApplication.withConfiguration() — New configuration support

Performance & Stability

• Core Resolver V2 — Fixed parameter stack propagation, injected params handling, and child scope/ViewModel scope resolution
• Scope Resolution & Thread Safety — Performance optimization with safer ScopeFactory protecting all operations from parallel calls
• ThreadLocal loading optimization — Avoid cost per Scope (#​2306)
• getAll no longer sorted by default — Instances come as declared; sort on purpose if needed
• Params stack access optimization

Bug Fixes

• Fix sharedKoinViewModel with type-safe navigation routes (#​2293)
• Fix qualified name usage in WASM (#​2312)
• Fix premature release of scope & context in Compose — don't drop in onForgotten (#​2274)
• Fix crashing declarations for LocalKoinScope & LocalKoinApplication
• Fix Compose Koin Context Loader and Entry Points (#​2327)
• Fix CoreResolution with Child Scopes / ViewModelScope (#​2325)
• Fix Scope Archetypes Qualifier in plugin support functions
• Fix qualifier conversion

Breaking Changes

• minSdk raised to 23 for Android
• module renamed to lazyModule in some contexts
• BeanDef constructor change (API signature update)

Dependencies

• Kotlin 2.3.20
• Ktor 3.4
• JetBrains Compose 1.10.2
• AndroidX Lifecycle 2.10.0
• AndroidX Navigation 2.9.7 / Nav3 1.0.1

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.