Bump io.ktor:ktor-version-catalog from 3.5.1 to 3.5.2

[dependabot]

Bumps io.ktor:ktor-version-catalog from 3.5.1 to 3.5.2.

Release notes

Sourced from io.ktor:ktor-version-catalog's releases.

3.5.2

Published 31 July 2026

Improvements

• KTOR-8032 RateLimit: Allow limit requests based on authentication result
• KTOR-9719 ApplicationCall.isStaticContent returns false when called from plugin interceptors
• KTOR-8450 ContentNegotiation: it doesn't handle content type suffixes
• KTOR-7892 SwaggerUI: Missing oauth2-redirect.html support in the plugin
• KTOR-9759 Reject whitespace in URL hosts during parsing
• KTOR-9681 Update kotlinx-io to 0.9.1
• KTOR-9743 ByteReadChannel.readLineStrict: Misleading definition of limit parameter in KDocs
• KTOR-9504 Improve KDoc for EmbeddedServer.addShutdownHook

Bugfixes

• KTOR-9741 CIO: request-handler coroutine leak on half-closed idle connection after ≥1MB response
• KTOR-7661 Maven + YAML config file does not work
• KTOR-9585 OpenAPI: JsonSchema title is truncated when it contains a dot
• KTOR-9704 UTF-8 encoding in ktor-io bypasses JVM String.getBytes intrinsics, slowing every text response by 5-7x
• KTOR-9588 SSE client (CIO engine) sends spurious Content-Length: 0 on body-less GET (RFC 9110 § 8.6 violation; rejected by AWS ELB)
• KTOR-9679 ByteReadChannel.readLine corrupts multi-byte UTF-8 by splitting a character at a buffer boundary
• KTOR-9767 ByteReadChannel.readLineTo: Return read bytes count instead of decoded characters count
• KTOR-8992 HoconConfigLoader is not loaded when ktor-server-config-yaml on the classpath
• KTOR-9698 OpenAPI: schema for kotlinx.serialization sealed types omits discriminator property in variant schemas
• KTOR-9690 Netty: in-flight requests are aborted on stop(), ignoring shutdown grace period
• KTOR-8903 Netty: Close channel connection on errors properly
• KTOR-9707 SaveBody performance regression
• KTOR-9703 Inefficient text reading function in DefaultTransform
• KTOR-9711 Netty HTTP/2: a single client-canceled stream (RST_STREAM) breaks response flushing for the whole connection
• KTOR-9688 RateLimit: No access to principal when wrapped with authentication since 3.5.1
• KTOR-9677 Auto-reloading: server is reloaded only once since 3.5.0
• KTOR-9683 Sockets: Canceling a SelectorManager job doesn't close it properly
• KTOR-9671 Darwin: Semicolons in URL path are sanitized

Changelog

Sourced from io.ktor:ktor-version-catalog's changelog.

3.5.2

Published 31 July 2026

Improvements

• KTOR-8032 RateLimit: Allow limit requests based on authentication result
• KTOR-9719 ApplicationCall.isStaticContent returns false when called from plugin interceptors
• KTOR-8450 ContentNegotiation: it doesn't handle content type suffixes
• KTOR-7892 SwaggerUI: Missing oauth2-redirect.html support in the plugin
• KTOR-9759 Reject whitespace in URL hosts during parsing
• KTOR-9681 Update kotlinx-io to 0.9.1
• KTOR-9743 ByteReadChannel.readLineStrict: Misleading definition of limit parameter in KDocs
• KTOR-9504 Improve KDoc for EmbeddedServer.addShutdownHook

Bugfixes

• KTOR-9741 CIO: request-handler coroutine leak on half-closed idle connection after ≥1MB response
• KTOR-7661 Maven + YAML config file does not work
• KTOR-9585 OpenAPI: JsonSchema title is truncated when it contains a dot
• KTOR-9704 UTF-8 encoding in ktor-io bypasses JVM String.getBytes intrinsics, slowing every text response by 5-7x
• KTOR-9588 SSE client (CIO engine) sends spurious Content-Length: 0 on body-less GET (RFC 9110 § 8.6 violation; rejected by AWS ELB)
• KTOR-9679 ByteReadChannel.readLine corrupts multi-byte UTF-8 by splitting a character at a buffer boundary
• KTOR-9767 ByteReadChannel.readLineTo: Return read bytes count instead of decoded characters count
• KTOR-8992 HoconConfigLoader is not loaded when ktor-server-config-yaml on the classpath
• KTOR-9698 OpenAPI: schema for kotlinx.serialization sealed types omits discriminator property in variant schemas
• KTOR-9690 Netty: in-flight requests are aborted on stop(), ignoring shutdown grace period
• KTOR-8903 Netty: Close channel connection on errors properly
• KTOR-9707 SaveBody performance regression
• KTOR-9703 Inefficient text reading function in DefaultTransform
• KTOR-9711 Netty HTTP/2: a single client-canceled stream (RST_STREAM) breaks response flushing for the whole connection
• KTOR-9688 RateLimit: No access to principal when wrapped with authentication since 3.5.1
• KTOR-9677 Auto-reloading: server is reloaded only once since 3.5.0
• KTOR-9683 Sockets: Canceling a SelectorManager job doesn't close it properly
• KTOR-9671 Darwin: Semicolons in URL path are sanitized

Commits

• 01c469a Release 3.5.2 (#5781)
• c965a0c KTOR-9741 Prevent CIO request handler leak (#5783)
• 74df458 chore: fix some comments to improve readability
• 2672567 [KTOR-9704] Optimized encoding flow for UTF-8 (#5743)
• d5680ed KTOR-5391: Document ECDSA certificate limitation for client authentication (#...
• 9b0f356 something::javaClass.name is not the name of the class of something but `"j...
• 58256cd KTOR-9743 Clarify readLine documentation
• 088bd60 KTOR-9679 Fix regressions caused by adding buffering
• 167176a KTOR-9588 Do not send Content-Length: 0 for body-less GET requests (#5620)
• 7fb0844 KTOR-9585 Fix schema title trimming
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)