[dependabot]

Bumps the kotlin-minor-patch group with 3 updates in the /packages/kilo-jetbrains directory: org.jetbrains.kotlinx:kotlinx-serialization-json, org.jetbrains.kotlin.jvm and org.jetbrains.kotlin.plugin.serialization.

Updates org.jetbrains.kotlinx:kotlinx-serialization-json from 1.11.0 to 1.12.0

Release notes

Sourced from org.jetbrains.kotlinx:kotlinx-serialization-json's releases.

v1.12.0

This release is based on Kotlin 2.4.10 and contains all of the changes from 1.12.0-RC.

Additionally, it includes a fix removing unnecessary leading whitespaces from Proguard rules (#3270), and two changes stabilizing kotlin.uuid.Uuid serializer (#3263) and kotlin.time.Instant serializers (#3261).

For your convenience, the changelog for 1.12.0-RC is duplicated below:

API stabilization and deprecations

A big portion of the Json and Core APIs has been stabilized. Most important ones include: @KeepGeneratedSerializer and @SerialInfo annotations, JsonNamingStrategy, and ContextualSerializer. Additionally, various descriptor builders such as listDescriptor and JsonElementBuilder's addAll functions are also stable and can be freely used. There is also one deprecation: ChunkedDecoder interface. Since there is no demand for it, we plan to remove it in the future. See details in the #3238, #3239, and #3216.

Also, kotlin.time.Instant and kotlin.uuid.Uuid serializers are no longer annotated with experimental annotations from the Kotlin standard library (see #3261 and #3263)

Performance improvements

We also improved performance in various areas. ASCII-specific parser (#3225) brings performance of decoding from Okio and kotlinx-io sources closer to decoding performance from String. #3220 makes decoding significantly faster in case JsonElement present in your serializable classes. And #3248 should bring overall performance improvements (up to 30%) on large strings.

Exceptions rework

We continue to improve exception handling in Json encoders and decoders. #3235 makes a big change around custom serializers and @Serializable classes constructors: from now on, every exception thrown during deserialization is wrapped by decoder into a JsonException. This way, it is more predictable to write a catch and it is easier to understand what went wrong: JsonDecodingException also includes context information such as Json path and input. Besides that, #3246 limits maximum nesting depth of Json document, so you will get a proper JsonDecodingException instead of a random stack overflow error.

CBOR improvements

CBOR format also gets many improvements in this release. The most important one is memory optimization for definitely-sized collections (#3191, #3192).

The others include:

• Encode unsigned integer types as positive integers (#3194) (thanks to Eyüp Can Akman)
• Correctly decode CborLabel values (#3195)
• Include actual tag info into CborDecodingException (#3197)

Protobuf improvements

Protocol buffers format received a big new feature: support for unknown fields. Using a new ProtoUnknownFieldHolder class, you can now decode and store unknown fields in Protobuf messages to retransmit them back later. See documentation updates and #2860 for details.

... (truncated)

Changelog

Sourced from org.jetbrains.kotlinx:kotlinx-serialization-json's changelog.

1.12.0 / 2026-10-19

This release is based on Kotlin 2.4.10 and contains all of the changes from 1.12.0-RC.

Additionally, it includes a fix removing unnecessary leading whitespaces from Proguard rules (#3270), and two changes stabilizing kotlin.uuid.Uuid serializer (#3263) and kotlin.time.Instant serializers (#3261).

For your convenience, the changelog for 1.12.0-RC is duplicated below:

API stabilization and deprecations

A big portion of the Json and Core APIs has been stabilized. Most important ones include: @KeepGeneratedSerializer and @SerialInfo annotations, JsonNamingStrategy, and ContextualSerializer. Additionally, various descriptor builders such as listDescriptor and JsonElementBuilder's addAll functions are also stable and can be freely used. There is also one deprecation: ChunkedDecoder interface. Since there is no demand for it, we plan to remove it in the future. See details in the #3238, #3239, and #3216.

Also, kotlin.time.Instant and kotlin.uuid.Uuid serializers are no longer annotated with experimental annotations from the Kotlin standard library (see [#3261](Kotlin/kotlinx.serialization#3261 and #3263)

Performance improvements

We also improved performance in various areas. ASCII-specific parser (#3225) brings performance of decoding from Okio and kotlinx-io sources closer to decoding performance from String. #3220 makes decoding significantly faster in case JsonElement present in your serializable classes. And #3248 should bring overall performance improvements (up to 30%) on large strings.

Exceptions rework

We continue to improve exception handling in Json encoders and decoders. #3235 makes a big change around custom serializers and @Serializable classes constructors: from now on, every exception thrown during deserialization is wrapped by decoder into a JsonException. This way, it is more predictable to write a catch and it is easier to understand what went wrong: JsonDecodingException also includes context information such as Json path and input. Besides that, #3246 limits maximum nesting depth of Json document, so you will get a proper JsonDecodingException instead of a random stack overflow error.

CBOR improvements

CBOR format also gets many improvements in this release. The most important one is memory optimization for definitely-sized collections (#3191, #3192).

... (truncated)

Commits

• 4c28c3e 1.12.0 release (#3295)
• abe8a96 Merge remote-tracking branch 'origin/master' into dev
• 952d17a Added Gradle task to prepare release (#3279)
• 6f30025 Remove Play verification files (#3266)
• 89b23ca Workaround watchosArm32 removal (#3291)
• 53932a0 Update links to Okio site and its docs (#3292)
• 3a5db3b Reduce the number of input fields for bug report
• 9ede0e2 Added templates to the issue creation wizard
• 5d3f884 Update Dokka to version 2.3.0-Beta (#3286)
• 1fe9a49 Suppress deprecation of nodejs in wasmWasi configuration (#3287)
• Additional commits viewable in compare view

Updates org.jetbrains.kotlin.jvm from 2.3.20 to 2.4.21

Updates org.jetbrains.kotlin.plugin.serialization from 2.3.20 to 2.4.21

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	maven/​org.jetbrains.kotlinx/​kotlinx-serialization-json@​1.11.0 ⏵ 1.12.0

View full report

[kilo-code-bot]

Code Review Summary

Status: 1 Issue Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	1
WARNING	0
SUGGESTION	0

Issue Details (click to expand)

CRITICAL

File	Line	Issue
packages/kilo-jetbrains/gradle/libs.versions.toml	7	kotlin-jvm-plugin 2.4.21 without an intellij-rpc-plugin 2.4.x build. build.gradle.kts:122 rejects a Kotlin/RPC minor mismatch at configuration time (2.4 vs 2.3), and the same 2.4.x bumps were previously closed for this reason (#14755, #14950, #15157, #15421). Hold the Kotlin bump or bump all three plugins together.

The kotlinx-serialization-json 1.11.0 → 1.12.0 update is compatible with Kotlin 2.4.10+ and is not the problem; the incompatibility is between the Kotlin compiler version and the RPC compiler plugin.

Files Reviewed (1 file)

• packages/kilo-jetbrains/gradle/libs.versions.toml - 1 issue

Fix these issues in Kilo Cloud

Previous Review Summary (commit 6cd6c6f)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 6cd6c6f)

Status: No Issues Found | Recommendation: Merge

Dependabot version bump only: kotlin-jvm-plugin, kotlin-serialization-plugin (2.3.20 → 2.4.21) and kotlinx-serialization-json (1.11.0 → 1.12.0) stay mutually consistent (serialization 1.12.0 is built against Kotlin 2.4.10), are referenced solely through libs.versions.toml refs, and no other Kotlin version pins or compiler options exist to drift. Build/typecheck/test coverage is handled by the existing JetBrains CI workflows.

Files Reviewed (1 file)

• packages/kilo-jetbrains/gradle/libs.versions.toml

---

_{Reviewed by deepseek-flash-latest · Input: 50.2K · Output: 4.6K · Cached: 361.9K}

_{Review guidance: REVIEW.md from base branch main}

[kilo-code-bot]

CRITICAL: Bumping kotlin-jvm-plugin to 2.4.21 while intellij-rpc-plugin stays on 2.3.21-RC2-0.1 breaks the JetBrains Gradle configuration.

packages/kilo-jetbrains/build.gradle.kts:122 fails the build when the Kotlin minor and RPC plugin minor differ (minor(compiler) != minor(rpc)), which is exactly what this bump produces (2.4 vs 2.3). The comment above this block and the enforcement itself were added after the earlier 2.4.x attempts: #14755, #14950, #15157 and #15421 were all closed for this reason. Without the guard, :shared:compileKotlin fails with an opaque IrGenerationExtension$Companion cannot be cast to ProjectExtensionDescriptor error.

Suggestion: hold this bump until an intellij-rpc-plugin build targeting Kotlin 2.4.x exists, then raise kotlin-jvm-plugin, kotlin-serialization-plugin and intellij-rpc-plugin in the same change. The kotlinx-serialization-json 1.11.0 → 1.12.0 part is fine on its own.