Skip to content

Upgrading io.ktor:ktor-client-core 2 to 3

Breaking2.3.13 → 3.6.1Breaking11Security4Deprecated10New142Changed84Fixed520Other17

Full comparisonBack to io.ktor:ktor-client-core
BreakingUpgrade verdict

11 breaking changes and 4 security fixes.

In plain terms
  • Projects that referenced the old shared JavaScript/Wasm target name must switch to the new name.
  • Authentication no longer requires certain marker interfaces, which may affect code relying on them.
  • Previously deprecated APIs are removed, so code still using them will no longer compile.
  • A function that reads a line now reports how many bytes it read rather than how many characters.
Must act Top 5 of 25 that need code or config changes

Adds io.ktor:ktor-http-cio 3.6.1, io.ktor:ktor-sse 3.6.1, org.jetbrains.kotlin:kotlin-stdlib 2.3.21.

Drops org.jetbrains.kotlin:kotlin-stdlib-common, org.jetbrains.kotlinx:atomicfu.

Installs 17 packages in all (was 16).

Also installs org.jetbrains.kotlinx:kotlinx-io-bytestring, org.jetbrains.kotlinx:kotlinx-io-core, org.jetbrains.kotlinx:kotlinx-serialization-core, org.jetbrains.kotlinx:kotlinx-serialization-core-jvm.

No longer installs org.jetbrains.kotlin:kotlin-stdlib-jdk7, org.jetbrains.kotlin:kotlin-stdlib-jdk8, org.jetbrains.kotlinx:atomicfu-jvm.

Moves org.jetbrains.kotlin:kotlin-stdlib 1.8.0 → 2.3.21, org.jetbrains.kotlinx:kotlinx-coroutines-core 1.7.1 → 1.11.0, org.jetbrains.kotlinx:kotlinx-coroutines-core-jvm 1.7.1 → 1.11.0, org.jetbrains:annotations 23.0.0 → 13.0. Your build may pick other versions.

7 packages of its own release move with it.

What you must change

Breaking11
Renames the jsAndWasmShared target to web.
jsAndWasmSharedweb
3.4.0GitHub ReleaseSummarizedView source
Auth drops marker interface requirements.
3.0.0GitHub ReleaseSummarizedView source
Drops old deprecations.
3.0.0-beta-1GitHub ReleaseSummarizedView source
ByteReadChannel.readLineTo now returns the count of read bytes instead of decoded characters.
ByteReadChannel.readLineTo
3.5.2GitHub ReleaseSummarizedView source
Makes DynamicProviderConfig.authenticateFunction suspend.
DynamicProviderConfig.authenticateFunction
3.5.0GitHub ReleaseSummarizedView source
Redesigns the ByteReadChannel.readUTF8Line API.
ByteReadChannel.readUTF8Line
3.4.0GitHub ReleaseSummarizedView source
Makes readUTF8LineTo return the number of read symbols instead of a boolean.
readUTF8LineTo
3.4.0GitHub ReleaseSummarizedView source
Deprecates withTestApplication APIs with ERROR level and migrates to testApplication.
withTestApplicationtestApplication
3.0.0-rc-2GitHub ReleaseSummarizedView source
Replaces java.time options in the Websockets plugin.
3.0.0-rc-2GitHub ReleaseSummarizedView source
Stops publishing an empty io.ktor:ktor Maven artifact.
io.ktor:ktor
3.0.0-rc-2GitHub ReleaseSummarizedView source
Makes LDAP Auth return a generic Principal instead of UserIdPrincipal.
PrincipalUserIdPrincipal
3.0.0-beta-1GitHub ReleaseSummarizedView source
Security4
Fixes infinite spin and potential OOM vulnerabilities in WebSockets Inflater.inflateFully.
Inflater.inflateFully
3.4.1GitHub ReleaseSummarizedView source
Fixes MicrometerMetrics OOM abuse via 404 requests with different paths.
MicrometerMetrics
3.1.3GitHub ReleaseSummarizedView source
Addresses the weak MD5 security algorithm used in FileCacheStorage.
FileCacheStorage
3.0.0GitHub ReleaseSummarizedView source
Fixes a denial-of-service via out-of-memory caused by unbound request body size.
3.0.0-beta-1GitHub ReleaseSummarizedView source

Deprecations to plan for

Deprecated10
Deprecates HttpHeaders.AcceptCharset.
HttpHeaders.AcceptCharset
3.5.0GitHub ReleaseSummarizedView source
Improves the deprecation notice for io.ktor.server.auth.Principal to explain what to use instead.
io.ktor.server.auth.Principal
3.5.0GitHub ReleaseSummarizedView source
Deprecates the DarwinLegacy engine.
DarwinLegacy
3.4.0GitHub ReleaseSummarizedView source
Deprecates the Apache 4 engine.
3.4.0GitHub ReleaseSummarizedView source
Deprecates the var Route.staticRootFolder: File? property.
Route.staticRootFolder
3.3.0GitHub ReleaseSummarizedView source
Deprecates HttpClientCall.wrapWithContent and HttpClientCall.wrap.
HttpClientCall.wrapWithContentHttpClientCall.wrap
3.2.0GitHub ReleaseSummarizedView source
Deprecates SaveBodyPlugin in favor of HttpClientCall.save.
SaveBodyPluginHttpClientCall.save
3.2.0GitHub ReleaseSummarizedView source
Deprecates old jetty, tomcat and servlet engines.
3.0.0-rc-1GitHub ReleaseSummarizedView source
Deprecates Locations with Level.ERROR.
LocationsLevel.ERROR
3.0.0-beta-1GitHub ReleaseSummarizedView source
Adds deprecations for the old IO API.
3.0.0-beta-1GitHub ReleaseSummarizedView source