[Osip Fatkullin (osipxd)]

Subsystem
Client/server engines, serialization, observability, build infrastructure

Motivation
Update dependencies for the upcoming minor release while retaining the current Kotlin 2.3.21 baseline and reviewing intervening upstream migrations and behavior changes.

Solution

Updated

Runtime dependencies:

• kotlinx-datetime 0.6.2 → 0.8.0-0.6.x-compat
• atomicfu 0.32.1 → 0.33.0
• Netty 4.2.16.Final → 4.2.17.Final
• netty-tcnative 2.0.81.Final → 2.0.83.Final
• Jetty Jakarta 12.1.12 → 12.1.13
• Tomcat 9.0.120 → 9.0.121
• Tomcat Jakarta 10.1.57 → 10.1.59
• Apache HttpClient 5 5.5.1 → 5.6.4
• OkHttp 5.3.2 → 5.5.0
• Okio 3.17.0 → 3.18.2
• Jackson 2 2.22.1 → 2.22.2
• Jackson 3 3.1.3 → 3.2.2
• SLF4J 2.0.18 → 2.0.19
• Dropwizard Metrics 4.2.39 → 4.2.40
• Micrometer 1.17.0 → 1.17.1
• FreeMarker 2.3.34 → 2.3.35
• Swagger Codegen 3.0.81 → 3.0.82
• Swagger Parser 2.1.45 → 2.1.48
• zstd-jni 1.5.7-11 → 1.5.7-16

Test and build dependencies:

• Android Gradle Plugin 9.3.0 → 9.4.0
• Kotlinter 5.6.0 → 5.7.0
• Logback 1.5.38 → 1.6.3
• common custom user data plugin 2.7.0 → 2.8.0
• Gradle 9.6.1 → 9.7.1
• Eclipse Temurin devcontainer 21.0.11_10 → 21.0.12_8
• actions/stale v10 → v11

Additional migrations:

• Replace the external jQuery WebJar test dependency with a generated test-only JAR. The tests still exercise asset discovery from a real JAR without tracking an unrelated JavaScript runtime dependency.
• Replace deprecated atomicfu arrays in the native MPSC queue with standard-library atomic arrays and add growth, reuse, FIFO, close/drain, and concurrent-producer tests.
• Disable Apache HttpClient's automatic per-request response decompression. HttpClient 5.6 otherwise delivers decoded bytes while retaining compressed response headers, conflicting with Ktor's ContentEncoding plugin and raw-body behavior. Request customization cannot re-enable Apache decoding; using Apache's decoder instead of Ktor's implementation remains a separate future design change.
• Add the Gradle 9.7 task annotations required by plugin validation and refresh the Wasm Yarn lockfile.

Compatibility notes

• kotlinx-datetime's compatibility artifact retains legacy Instant/Clock classes, but 0.8 removes automatic serialization support from TimeZone and FixedOffsetTimeZone. Applications relying on automatic serializer lookup may need explicit serializers or string timezone IDs. Consumer-model compatibility was not independently tested.
• Jackson 3.2 removes KotlinFeature.NewStrictNullChecks; StrictNullChecks is the replacement already used by Ktor. Previously compiled consumers referencing the removed enum member may fail linkage.
• Tomcat changes the protected FormAuthenticator.restoreRequest(Request, Session) result from boolean to AuthenticationResult and moves dispatch to doAuthenticateExtended; custom consumer subclasses need migration.
• FreeMarker 2.3.35 removes freemarker.debug and old CLI APIs. Ktor retains its existing incompatible_improvements setting.
• zstd-jni no longer decodes legacy pre-1.0 Zstd formats 0.4–0.7. Modern HTTP Zstd frames are unaffected by that removal.
• Common custom user data 2.8.0 adds AI / AI agent=Copilot build-scan data when COPILOT_CLI or COPILOT_AGENT is present. ktor.develocity.skipBuildScans=true continues to prevent publication.

Deferred / skipped

• Kotlin, compiler API, and Kotlin wrappers: retain the existing project/compiler baseline for this update.
• Kaml 0.104.0: bytecode compiled for JVM 11 cannot be inlined into Ktor's JVM 8 target; retained 0.79.0.
• XMLUtil 1.x, Jakarta Servlet 6/Tomcat 11, JUnit 6, coordinated Rust/WebRTC updates, Develocity main plugin, Temurin 25, and other production major updates require separate migrations.
• Gobley is deferred until 0.3.8.

Validation

• Combined targeted JVM and macOS ARM64 tests: 1,703 passed, 48 skipped, 0 failed (build scan).
• Apache5 and content-encoding tests passed against both HttpClient 5.5.1 and 5.6.4; the new regressions failed on unadapted 5.6.4 before the engine fix.
• Affected module assembly, formatting, lint, and applicable ABI checks passed.
• build-logic and build-settings-logic checks, plugin validation, and assembly passed.
• Gradle wrapper generation ran twice; distribution and wrapper JAR checksums were verified.
• Wasm lockfile validation and WebJar fixture isolation checks passed.
• JS/Wasm runtime test tasks were skipped by the configured build and remain for CI; native queue execution was validated on macOS ARM64.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-08T22:27:36.410802Z	7b2ebca	Draft marked ready
🔒 Security Review	✅ Completed 2026-09-08T22:38:38.349155Z	7b2ebca	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "Codex (@codex) review" or "Codex (@codex) security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Osip Fatkullin (osipxd)]

Also fixes: KTOR-9832 Apache5: Upgrading Apache HttpClient5 to version 5.6 breaks the Ktor client with Content-Length mismatch error for any gzipped content