Update all dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Age	Confidence
actions/setup-java	action	minor	v5.6.0 → v5.7.0
gradle (source)		minor	9.6.1 → 9.7.0
com.google.firebase:firebase-bom	dependencies	minor	34.16.0 → 34.17.0
dev.zacsweers.metro	plugin	minor	1.3.2 → 1.4.1
dev.zacsweers.metro:metrox-viewmodel-compose	dependencies	minor	1.3.2 → 1.4.1
dev.zacsweers.metro:metrox-viewmodel	dependencies	minor	1.3.2 → 1.4.1
androidx.navigation3:navigation3-ui (source)	dependencies	patch	1.2.0-alpha06 → 1.2.0-alpha07
androidx.navigation3:navigation3-runtime (source)	dependencies	patch	1.2.0-alpha06 → 1.2.0-alpha07
app.rive:rive-android (source)	dependencies	minor	11.7.2 → 11.8.0
io.ktor:ktor-client-logging	dependencies	patch	3.5.1 → 3.5.2
io.ktor:ktor-serialization-kotlinx-json	dependencies	patch	3.5.1 → 3.5.2
io.ktor:ktor-client-darwin	dependencies	patch	3.5.1 → 3.5.2
io.ktor:ktor-client-core	dependencies	patch	3.5.1 → 3.5.2
io.ktor:ktor-client-content-negotiation	dependencies	patch	3.5.1 → 3.5.2
io.ktor:ktor-client-cio	dependencies	patch	3.5.1 → 3.5.2
io.ktor:ktor-client-auth	dependencies	patch	3.5.1 → 3.5.2
io.ktor:ktor-client-android	dependencies	patch	3.5.1 → 3.5.2
com.google.devtools.ksp (source)	plugin	patch	2.3.10 → 2.3.11
com.google.devtools.ksp:symbol-processing-api (source)	dependencies	patch	2.3.10 → 2.3.11
com.datadoghq.dd-sdk-android-gradle-plugin	plugin	minor	1.29.0 → 1.30.0

---

Release Notes

actions/setup-java (actions/setup-java)

v5.7.0

Compare Source

gradle/gradle (gradle)

v9.7.0

Compare Source

ZacSweers/metro (dev.zacsweers.metro)

v1.4.1

Compare Source

2026-08-06

New

• [FIR/IR/Circuit] Generate CircuitSerializerRegistration Set contributions for @CircuitSerializable Screen and PopResult types when using Circuit 0.36.0 or newer.

Fixes

• [FIR/IR] Generate contribution hints in FIR alongside IR class generation (Kotlin 2.4.20+), fixing downstream discovery for Metro's built-in contributions on all platforms.
• [FIR] Report an error when one annotation class combines multiple qualifier, scope, or map-key markers, such as both @Qualifier and @MapKey.
• [IR] Fix duplicate qualifier annotations on parameters of IR-generated member-injector methods.
• [IR] Inject inherited members in superclass-first order when using graph injection methods.
• [IR] Report duplicate bindings inherited from a parent graph when they are only requested by a child graph extension.
• [IR] Fix @GraphExtension.Factory replacements across additionalScopes when generating classes in IR.
• [IR] Correctly report dependency cycles when the same dependency is requested both directly and through a provider or lazy value.
• [IR] Prevent stack overflows in large dependency graphs by checking cycles with heap-backed frames instead of recursive DFS traversal.
• [IR] Minimize deferred bindings when breaking overlapping dependency cycles.
• [IR] Do not require suspend provider support for caller-supplied suspend function @Assisted parameters.
• [IR] Fix a stack overflow when a nested graph extension requests a parent-scoped binding with suspend providers enabled.
• [IR] Prevent stack overflows while generating deeply nested/complex dependency graph expressions.
• [IR] Show shorter, consistent dependency paths in graph errors with improved route caching.
• [IC] Fix incremental compilation issue when adding or removing member injections from a superclass.

Changed

• Mentioned above in the fixes, but worth reiterating! Previously, graph-level member injector functions would incorrectly inject subclasses before ancestor classes. Now it correctly injects ancestors first, matching how MembersInjector and constructor-injected classes with member injection work. If you were relying on that behavior by accident, it's going to be different now!

Contributors

Special thanks to the following contributors for contributing to this release!

• @​scana

Consider sponsoring Metro's development

v1.4.0

Compare Source

2026-07-30

New

Experimental support for suspend providers

This release introduces experimental support for suspend providers. This is disabled by default and can be enabled by the metro.enableSuspendProviders option. See the coroutines documentation for details.

• @Provides functions and graph accessors can be suspend. Suspension propagates through dependent bindings. Metro reports a dependency trace when a non-suspend path reaches one.
• Inject suspend () -> T to defer initialization until invocation, or SuspendLazy<T> to also cache the first successful result. Provider, function providers, Lazy, SuspendProvider, suspend functions, and SuspendLazy can be nested to any depth in a scalar wrapper stack.
  • When the underlying binding suspends, the wrapper closest to it must also support suspension. Maps can defer initialization of individual values with Map<K, suspend () -> V> or Map<K, SuspendProvider<V>>.
  • Wrapper layers and supported map values preserve nullable binding types.
• Like ordinary scoped bindings, scoped suspend bindings are single-flight and retry after failures or cancellation. They also run on the coroutine context they were called on, so if this is important then you should use an appropriate withContext within your provider body.
• The Gradle plugin automatically adds the new runtime-coroutines artifact when suspend providers are enabled. If runtime dependencies are managed manually, add it for scoped suspend bindings, suspendLazy, and injection requests containing SuspendLazy at any nesting level.
  • runtime-coroutines uses kotlinx-coroutines on every platform.
• Note: Switching providers do not yet support suspend providers. You can still enable them, just scoped suspend provider fields will not be sharded into nested switching provider classes yet.

Other new stuff

• [FIR/IR/Circuit] Support sub-circuits (i.e. the new @SubCircuitInject annotation).

Enhancements

• Support private @Provides properties on Kotlin 2.4.20-Beta1 and newer.
• [IR] Improve IC on Kotlin 2.3.20 by backporting compat support for the compiler's new declaration finder APIs.
• [IR] Avoid generating unused provider fields for included graph accessors that can be read directly.
• [IR] Avoid linear helper traversal in large switching providers by routing directly to the matching chunk.
• [runtime] If the input function to provider() is already a Provider instance, return it directly rather than needlessly wrap it.
• [runtime] Support nullable values in ordinary map multibinding factories, including provider and lazy map value forms.

Fixes

• [FIR] Report a diagnostic when private @Provides properties are used without compiler support (i.e. pre-2.4.20).
• [FIR] Report an error when a map key is applied (via type argument) to a binding without a corresponding @IntoMap or @ContributesIntoMap annotation.
• [IR] Fix stale contribution hints after changing a contribution's scope during incremental compilation. This only affects Kotlin versions prior to 2.3.20.
• [IR] Fix Kotlin/Native compilation failures when generated hidden classes were missing their Any supertype.
• [IR] Prevent directly provided maps from satisfying suspend-provider-valued map requests unless the provided map uses that exact value type.
• [IR] Avoid redundant nested DoubleCheck.lazy() calls when materializing Lazy graph accessors and binding parameters.
• [IR] Correctly adapt function-provider accessors from included graphs when storing them as Metro Provider fields.
• [IR] Fix graph implementations incorrectly inheriting the containing class of nested @ContributesTo interfaces with IR class generation.
• [IR] Don't inline object, enum, or class-literal provider bindings when they're requested through Provider, Lazy, or provider-based multibindings.
• [gradle] Respect metro.generateClassesInIr Gradle and system property overrides instead of replacing them with the Kotlin-version default.
• Improve Kotlin 2.4.20-Beta2 support.

Changes

• Refreshed benchmarks!
  • They now run against latest Metro, Dagger, and KSP versions.
    • Dagger + KSP have improved significantly 🚀.
  • They now also include Koin.
• Build against Kotlin 2.4.10. Note the runtime artifacts still target Kotlin 2.3.0 and Metro supports a wide range of compiler versions. See the compatibility docs for a full table of compatible versions.
• Test IntelliJ 2026.2 stable.
• Test Android Studio Quail 4 canaries.
• Switch shaded Mordan dependency to just mordant-core.
• Update shaded Okio dependency to 3.18.1.
• Update androidx.tracing to 2.0.0-rc01.

Contributors

Special thanks to the following contributors for contributing to this release!

• @​kevinguitar
• @​kyay10

Consider sponsoring Metro's development

rive-app/rive-android (app.rive:rive-android)

v11.8.0

Compare Source

• fix(Android): Generational state machine settling (#​13249) dd7c364 dad2d1d
• fix(Android): Correctly handle conversion between C++ and JVM strings (#​13105) 3959968 e6eb5ef
• feat(Android): VMI name (#​13079) 2a59ec4 b7cee78

ktorio/ktor (io.ktor:ktor-client-logging)

v3.5.2

Compare Source

Published 31 July 2026

Improvements

• KTOR-8032 RateLimit: Allow limit requests based on authentication result
• KTOR-9719 ApplicationCall.isStaticContent returns false when called from plugin interceptors
• KTOR-8450 ContentNegotiation: it doesn't handle content type suffixes
• KTOR-7892 SwaggerUI: Missing oauth2-redirect.html support in the plugin
• KTOR-9759 Reject whitespace in URL hosts during parsing
• KTOR-9681 Update kotlinx-io to 0.9.1
• KTOR-9743 ByteReadChannel.readLineStrict: Misleading definition of limit parameter in KDocs
• KTOR-9504 Improve KDoc for EmbeddedServer.addShutdownHook

Bugfixes

• KTOR-9741 CIO: request-handler coroutine leak on half-closed idle connection after ≥1MB response
• KTOR-7661 Maven + YAML config file does not work
• KTOR-9585 OpenAPI: JsonSchema title is truncated when it contains a dot
• KTOR-9704 UTF-8 encoding in ktor-io bypasses JVM String.getBytes intrinsics, slowing every text response by 5-7x
• KTOR-9588 SSE client (CIO engine) sends spurious Content-Length: 0 on body-less GET (RFC 9110 § 8.6 violation; rejected by AWS ELB)
• KTOR-9679 ByteReadChannel.readLine corrupts multi-byte UTF-8 by splitting a character at a buffer boundary
• KTOR-9767 ByteReadChannel.readLineTo: Return read bytes count instead of decoded characters count
• KTOR-8992 HoconConfigLoader is not loaded when ktor-server-config-yaml on the classpath
• KTOR-9698 OpenAPI: schema for kotlinx.serialization sealed types omits discriminator property in variant schemas
• KTOR-9690 Netty: in-flight requests are aborted on stop(), ignoring shutdown grace period
• KTOR-8903 Netty: Close channel connection on errors properly
• KTOR-9707 SaveBody performance regression
• KTOR-9703 Inefficient text reading function in DefaultTransform
• KTOR-9711 Netty HTTP/2: a single client-canceled stream (RST_STREAM) breaks response flushing for the whole connection
• KTOR-9688 RateLimit: No access to principal when wrapped with authentication since 3.5.1
• KTOR-9677 Auto-reloading: server is reloaded only once since 3.5.0
• KTOR-9683 Sockets: Canceling a SelectorManager job doesn't close it properly
• KTOR-9671 Darwin: Semicolons in URL path are sanitized

google/ksp (com.google.devtools.ksp)

v2.3.11

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.