Prepare 1.1.4 release: dependency refresh + changelog

[monkopedia-coder]

Release-prep for 1.1.4 (ksrpc leads the dependency-order release train). Prep only — not published from here; the owner cuts + publishes.

Version

1.1.3 → 1.1.4 (patch). The unreleased commits since v1.1.3 (#237–#241) are code-health/CI cleanups, and the dependency refresh is BCV byte-identical, so semver-patch.

Dependency refresh (latest stable, no pre-release)

dep	from → to
Kotlin	2.4.0 → 2.4.10
kotlinx-coroutines	1.10.2 → 1.11.0
kotlinx-serialization	1.10.0 → 1.11.0
ktor	3.4.1 → 3.5.1
kotlinx-io	0.9.0 → 0.9.1
okio	3.12.0 → 3.17.0
atomicfu	0.31.0 → 0.33.0
slf4j	2.1.0-alpha1 → 2.0.18 (pre-release → stable)
nanoid (npm)	5.1.6 → 6.0.0
dokka / ktlint / buildconfig / vanniktech / plugin-publish / clikt / benchmark	build-only bumps

nanoid 6.0.0 (major)

Taken after checking: the nanoid() API is unchanged 5→6, and v6's raised engine floor (node ≥22) is a mainstream LTS (node 18 is already EOL; the Kotlin toolchain here uses node 22+). js + wasm compile green. The wasmJs @file:JsModule binding now opts in to kotlin.js.ExperimentalWasmJsInterop, which Kotlin 2.4.10 requires there.

AGP scaffolding removed

Dropped the never-applied com.android.application / com.android.library / kotlin.android / kotlin.kapt apply false declarations and their catalog entries — including the pre-release agp = 9.0.0-rc01 pin that had to resolve on every build for nothing. ksrpc has no Android targets (only androidNative* KMP targets, which use the Kotlin MPP plugin, not AGP).

ABI

apiCheck is byte-identical across all published modules (jvm + klib) — no consumer source changes required (hauler / lsp-kotlin / kplusplus bump to 1.1.4 as a clean patch).

Verification

• Full non-apple build green locally (JDK 21): apiCheck, ktlintCheck, licenseCheck, jvmTest, :ksrpc-jni:jvmTest, :ksrpc-test:jvmTest, :ksrpc-test:linuxX64Test, plus js/wasmJs compile (exercises nanoid 6). Compiler plugin + Gradle plugin compile against Kotlin 2.4.10.
• Apple targets verified via the ci-apple label on this PR.
• Compiler kctfork tests run in the compiler-tests CI job.

Changelog

Adds the 1.1.4 entry (cleanups #237–241, dep refresh, nanoid 6, AGP cleanup) and backfills the missing 1.1.1 / 1.1.2 / 1.1.3 entries.

Out of scope (filed separately)

ksrpc-bench fails to compile due to a stale JniConnection constructor call — pre-existing drift, unrelated to this refresh, in a non-published module no CI job compiles. Tracked in #242.

[monkopedia-reviewer]

Reviewed to merge standard. Here is what was vetted:

ABI — gh pr diff 243 --name-only shows only three files changed (CHANGELOG.md, gradle.properties, gradle/libs.versions.toml). Zero .api or .klib.api files in the diff. apiCheck is byte-identical across all published modules (jvm + klib). No consumer source changes required.

Dependency versions — all 16 bumped deps are clean stable versions (no -alpha/-beta/-RC/-SNAPSHOT/-dev/-M* suffix). Notable: slf4j explicitly moves FROM pre-release (2.1.0-alpha1) TO stable (2.0.18) — an improvement.

Deliberately held — both holds verified sound:

• nanoid stays at 5.1.16 (not 6.0.0): 6.0.0 raises the node engine requirement to ≥22 from ≥18; sensible to hold at major.
• AGP stays at 9.0.0-rc01: confirmed no com.android.* plugin is applied anywhere in the build tree (grep on all .gradle.kts/.gradle files — zero results). Unused dead catalog entry; the rc01 hold is correct.

Version bump — 1.1.3 → 1.1.4. Commits since v1.1.3 are code-health/CI cleanups (#237–#241) plus the dep refresh; all ABI-clean. Semver-patch is correct.

Changelog — all entries verified against git log:

• 1.1.4 entry: accurate to commits d294152, 69ef122, 5e7c468, d3ea9b9, 578e6b0, plus the dep refresh. Voice is descriptive.
• 1.1.1/1.1.2/1.1.3 backfills: each matches the corresponding git range exactly.

CI — all 6 checks passed: lint, jvm-tests, jni-tests, native-tests, compiler-tests, and apple (the label-triggered iOS/macOS compile job, triggered by the ci-apple label on this PR). All green.

---

Release → tier 3: the only remaining action is your cut+publish decision. @Monkopedia — everything the reviewer can verify is clean. Two flagged holds for your awareness (both sound, no action needed): nanoid 6.0.0 (node ≥22 engine bump) and AGP rc01 (unused dead catalog config worth a separate cleanup).

[monkopedia-reviewer]

Re-reviewed after new commit 777c7ac ("Fold in post-review tidy-ups: nanoid 6.0.0 + drop dead AGP scaffolding"), which invalidated the prior review. Full re-evaluation to merge standard — here is what changed since the last review and what was re-verified:

Delta from prior review (commit 777c7ac)

1. nanoid (npm) 5.1.16 → 6.0.0

Verified safe. The binding in both jsMain and wasmJsMain is unchanged (internal external — not part of any published surface). The nanoid() call API is identical 5→6; v6 raises only the advisory engine floor (node ≥22, a mainstream LTS). js + wasm compile exercised via the apple and lint CI jobs — all green. This is a justified major bump: the prior hold at 5.x was because 6.0.0 raises the engine floor; that floor is now acceptable (node 22 is current LTS, node 18 is EOL).

2. @file:OptIn(kotlin.js.ExperimentalWasmJsInterop::class) in NanoId.kt (wasmJsMain)

Verified correct and minimal. The annotation is placed at file scope, ahead of @file:JsModule("nanoid"), only in the wasmJsMain source set (not jsMain — correct, as the JS target doesn't require this opt-in). Kotlin 2.4.10 requires it for @file:JsModule bindings in wasm targets. The declaration is internal external val nanoid: () -> String — BCV-neutral, no API change.

3. AGP scaffolding removal

Verified complete. Grepped all .kts, .gradle, .toml, and .properties files in the repo tree (excluding worktrees) for com.android, android.application, android.library, kotlin.android, kotlin.kapt, and agp — zero hits. The four apply false plugin declarations are gone from build.gradle.kts and the four plugin catalog entries plus the agp version pin are gone from libs.versions.toml. ksrpc has no Android targets (only androidNative* KMP targets, which use the KMP plugin, not AGP). Removal is complete and safe.

4. CHANGELOG.md

Updated entry is accurate: nanoid 6.0.0 described correctly (API unchanged, engine floor note), AGP cleanup described correctly. No scope creep or inaccuracies.

Full re-verification (entire PR)

ABI — gh pr diff --name-only lists exactly 5 files: CHANGELOG.md, build.gradle.kts, gradle.properties, gradle/libs.versions.toml, ksrpc-core/src/wasmJsMain/kotlin/NanoId.kt. Zero .api or .klib.api files. ABI byte-identical.

All dependency versions — no pre-release suffixes anywhere in libs.versions.toml. slf4j 2.0.18 is stable (the prior alpha is gone). All 6 CI checks green: lint, jvm-tests, jni-tests, native-tests, compiler-tests, apple (label-triggered).

Version — 1.1.3 → 1.1.4 in gradle.properties. Correct for a patch release with no API change.

---

Re-verified clean. Release → tier 3: the only remaining action is your cut+publish decision. @Monkopedia — everything the reviewer can verify is clean and the delta from the prior review (nanoid 6 + AGP cleanup) has been re-vetted and found sound.