Update ktor monorepo to v3.3.0

[renovate]

Coming soon: The Renovate bot (GitHub App) will be renamed to Mend. PRs from Renovate will soon appear from 'Mend'. Learn more here.

This PR contains the following updates:

Package	Change	Age	Confidence
io.ktor:ktor-utils	3.2.0 -> 3.3.0
io.ktor:ktor-network	3.2.0 -> 3.3.0
io.ktor:ktor-io	3.2.0 -> 3.3.0
io.ktor:ktor-client-java	3.2.0 -> 3.3.0
io.ktor:ktor-client-okhttp	3.2.0 -> 3.3.0
io.ktor:ktor-client-apache	3.2.0 -> 3.3.0
io.ktor:ktor-client-cio	3.2.0 -> 3.3.0
io.ktor:ktor-client-core	3.2.0 -> 3.3.0
io.ktor:ktor-server-test-host	3.2.0 -> 3.3.0
io.ktor:ktor-server-websockets	3.2.0 -> 3.3.0
io.ktor:ktor-server-compression	3.2.0 -> 3.3.0
io.ktor:ktor-server-tomcat-jakarta	3.2.0 -> 3.3.0
io.ktor:ktor-server-cio	3.2.0 -> 3.3.0
io.ktor:ktor-server-jetty-jakarta	3.2.0 -> 3.3.0
io.ktor:ktor-server-netty	3.2.0 -> 3.3.0
io.ktor:ktor-server-core	3.2.0 -> 3.3.0

---

Release Notes

ktorio/ktor (io.ktor:ktor-utils)

v3.3.0

Published 11 September 2025

Features

• Support for server side http2 without tls (h2c) (KTOR-4750)
• OpenAPI generation build extension preview (KTOR-8721)
• Serve static resources with caching headers and ETag based on sha256 of content (KTOR-6700)
• Jetty engine: Upgrade Jetty dependencies to the latest version 12 (KTOR-6734)
• Static content: Support a custom respond logic if the file is not found (KTOR-8496)
• Upgrade OkHttp to version 5.0.0 (KTOR-8652)
• WebRTC Client, Android + WASM (KTOR-7958)

Improvements

• SSE: Cannot read response body from SSEClientException (KTOR-8165)
• SSE: "SSEClientException: Content-Length mismatch" on saving response body in DefaultResponseValidation (KTOR-8753)
• var Route.staticRootFolder: File? should be deprecated (KTOR-5836)
• Add image/bmp to the ContentType (KTOR-8735)
• Add some missing image content types (KTOR-8624)
• Upgrade to Kotlin 2.2 (KTOR-8647)
• Bump Kotlin API level to 2.2 (KTOR-8637)
• CIO: The engine ignores system proxy settings (KTOR-5922)

Bugfixes

• Performance regression when using ContentEncoding and HttpRequestRetry since 3.2.0 (KTOR-8820)
• Big number of simultaneous outbound web socket connections leads to a coroutine deadlock (KTOR-8829)
• DI: JobCancellationException during cleanup (KTOR-8785)
• Autoreloading: JobCancellationException when app is reloaded in the debugger since 3.2.0 (KTOR-8810)
• HttpRedirect: The client is redirected when no Location header in response (KTOR-8697)
• SerializationException when Application.propertyOrNull() is called with type Map<String, Any?> (KTOR-8781)
• "Failed resolution of: Ljava/lang/management/ManagementFactory" on Android when JvmGcMetrics are initialized (KTOR-8714)
• HttpCache: all header values but first in HttpResponse.varyKeys() are ignored (KTOR-6402)
• HttpCache: plugin selects wrong cache entry when filtering Vary headers with different case (KTOR-7621)
• CountedByteWriteChannel: autoFlush of the source channel doesn't make the channel auto flushing (KTOR-8411)

v3.2.3

Published 29 July 2025

Improvements

• Server only accepts yaml as the configuration file suffix (KTOR-8712)
• JS / WASM error when process global is undefined (KTOR-8686)
• DI async duplicate resolution (KTOR-8681)

Bugfixes

• CIO: Expect 100-continue response is missing a final \r\n (KTOR-8687)
• Intermittent "ParserException: No colon in HTTP header" when parsing multipart request (KTOR-8523)
• Infinite loop in ByteReadChannel.readFully (KTOR-8682)
• ShutDownUrl: The server cannot shut down since 3.2.0 (KTOR-8674)

v3.2.2

Published 14 July 2025

Improvements

• SSE: Change the order of SSE field serialization: put event before data (KTOR-8627)

Bugfixes

• CORS: server replies with the 405 status code on a preflight request when the plugin is installed in a route (KTOR-4499)
• Darwin: The Content-Encoding header is removed since 3.0.3 (KTOR-8526)
• JS/WASM: response doesn't contain the Content-Length header in a browser (KTOR-8377)
• StatusPages: response headers of OutgoingContent aren't available in the status handlers (KTOR-8232)
• testApplication: The client.sse() acts like a REST call and not a stream in test environment (KTOR-7910)
• Config deserialization - default properties problem (KTOR-8654)
• kotlinx.datetime is not available transitively in 3.2.1 (KTOR-8656)
• Request builder block overrides HTTP method in specific request builders (get, post, etc) (KTOR-8636)

v3.2.1

Published 3 July 2025

Improvements

• Replace kotlinx.datetime APIs with kotlin.time (KTOR-8635)
• Thymeleaf: null values in template model (KTOR-8559)
• Publish Javadoc as a maven artifact (KTOR-3962)
• Netty: Invalid hex byte with malformed query string (KTOR-2934)

Bugfixes

• "Space characters in SimpleName" error when executing R8 mergeExtDex task with 3.2.0 (KTOR-8583)
• ForwardedHeaders: the plugin does not handle parameters case-insensitively (KTOR-8622)
• Potential race condition in socket.awaitClosed (hangs indefinitely) since 3.2.0 (KTOR-8618)
• Module parameter type Application.() -> kotlin.Unit is not supported in 3.2.0 (KTOR-8602)
• OkHttp: java.net.ProtocolException when sending MultiPartFormDataContent with onUpload (KTOR-6790)
• OAuth2 authentication provider breaks form-urlencoded POST requests when receiving request body (KTOR-4420)
• 404 for a link in KDoc for io.ktor.server.plugins.contentnegotiation.ContentNegotiation (KTOR-8597)
• Ktor fails to boot with default jvminline argument (KTOR-8608)
• Flow invariant is violated since 3.2.0 (KTOR-8606)
• ResponseSent hook handler of the plugin installed into a route isn't executed when an exception is thrown from the route (KTOR-6794)

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}