Update dependency org.jetbrains.kotlinx:kotlinx-serialization-json to v1.7.3

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
org.jetbrains.kotlinx:kotlinx-serialization-json	1.4.1 -> 1.7.3

---

Release Notes

Kotlin/kotlinx.serialization (org.jetbrains.kotlinx:kotlinx-serialization-json)

v1.7.3

==================

This release aims to fix important issues that were discovered in the 1.7.2 release,
including the inability to sync certain projects into Android Studio/IntelliJ IDEA and exceptions from custom Uuid serializers.

It uses Kotlin 2.0.20 by default.

• Use explicit kotlin-stdlib and kotlin-test versions from version catalog (#​2818)
• Drop usage of deprecated Any?.freeze() in K/N target (#​2819)
• Check against serialName instead of simpleClassName (#​2802)
• Ignore NoClassDefFoundError when initializing builtins map for serializer() function (#​2803)
• Clarify example for SerializationException (#​2806)

v1.7.2

==================

This release provides several new features, including a major Cbor configuration rework.
It uses Kotlin 2.0.20 by default.

Cbor feature set for COSE compliance

This change brings a lot of features to the CBOR format, namely:

• Serial Labels — see @CborLabel annotation and preferCborLabelsOverNames flag.
• Tagging of keys and values — see encode*Tags and verify*Tags set of flags
• Definite length encoding — see useDefiniteLengthEncoding. This flag affects object encoding, since decoding of arrays with definite lenghts is automatically supported.
• Option to globally prefer major type 2 for byte array encoding — see alwaysUseByteString flag.

Since there are quite a lot of flags now, they were restructured to a separate CborConfiguration class, similarly to JsonConfiguration.
It is possible to retrieve this configuration from CborEncoder/CborDecoder interfaces in your custom serializers (see their documentation for details).

All of these features make it possible to serialize and parse COSE-compliant CBOR, for example, ISO/IEC 18013-5:2021-compliant mobile driving license data.
In case you want to make use of them, there is a predefined Cbor.CoseCompliant instance.
However, some canonicalization steps (such as sorting keys) still need to be performed manually.

This functionality was contributed to us by Bernd Prünster.

Keeping generated serializers

One of the most requested features for serialization plugin was to continue to generate a serializer even if a custom one is specified for the class.
It allows using a plugin-generated serializer in a fallback or delegate strategy, accessing type structure via descriptor, using default serialization behavior in inheritors that do not use custom serializers.

Starting with this release, you can specify the @KeepGeneratedSerializer annotation on the class declaration to instruct the plugin to continue generating the serializer.
In this case, the serializer will be accessible using the .generatedSerializer() function on the class's companion object.

This annotation is currently experimental. Kotlin 2.0.20 or higher is required for this feature to work.

You can check out the examples in the documentation and in the PRs: #​2758, #​2669.

Serializer for kotlin.uuid.Uuid

Kotlin 2.0.20 added a common class to represent UUIDs in a multiplatform code.
kotlinx.serialization 1.7.2 provides a corresponding Uuid.serializer() for it, making it possible to use it in @Serializable classes.
Note that for now, serializer should be provided manually with @Contextual annotation.
Plugin will be able to automatically insert Uuid serializer in Kotlin 2.1.0.

See more details in the corresponding PR.

Other bugfixes and improvements

• Prohibited using of zero and negative field numbers in ProtoNumber (#​2766)
• Improve readability of protobuf decoding exception messages (#​2768) (thanks to xiaozhikang0916)
• docs(serializers): Fix grammatical errors (#​2779) (thanks to jamhour1g)
• Fixed VerifyError after ProGuard optimization (#​2728)
• Add wasm-wasi target to Okio integration (#​2727)

v1.7.1

==================

This is a bugfix release that aims to fix missing kotlinx-serialization-hocon artifact.
It also contains experimental integration with kotlinx-io library.
Kotlin 2.0.0 is used by default.

Fixed HOCON publication

Sadly, 1.7.0 release was published incomplete: kotlinx-serialization-hocon artifact is missing from 1.7.0 and 1.7.0-RC releases.
This release fixes this problem and now kotlinx-serialization-hocon is available again with 1.7.1 version.
No other changes were made to this artifact. Related ticket: #​2717.

Add integration with a kotlinx-io library

kotlinx-io is an official multiplatform library that provides basic IO primitives, similar to Okio.
kotlinx.serialization integration is now available in a separate artifact, located at the kotlinx-serialization-json-io coordinates.
Integration artifact provides functions similar to existing Okio integration: encodeToSink, decodeFromSource, and decodeSourceToSequence.
Check out the PR for more details.

Other bugfixes

• Prohibited use of elements other than JsonObject in JsonTransformingSerializer with polymorphic serialization (#​2715)

v1.7.0

==================

This release contains all of the changes from 1.7.0-RC and is compatible with Kotlin 2.0.
Please note that for reasons explained in the 1.7.0-RC changelog, it may not be possible to use it with the Kotlin 1.9.x
compiler plugin. Yet, it is still fully backwards compatible with previous versions.

The only difference with 1.7.0-RC is that classDiscriminatorMode property in JsonBuilder is marked as experimental,
as it should have been when it was introduced (#​2680).

v1.6.3

==================

This release provides a couple of new features and uses Kotlin 1.9.22 as default.

Class discriminator output mode

Class discriminator provides information for serializing and deserializing polymorphic class hierarchies.
In case you want to encode more or less information for various third party APIs about types in the output, it is possible to control
addition of the class discriminator with the JsonBuilder.classDiscriminatorMode property.
For example, ClassDiscriminatorMode.NONE does not add class discriminator at all, in case the receiving party is not interested in Kotlin types.
You can learn more about this feature in the documentation and corresponding PR.

Other features

• Add kebab-case naming strategy (#​2531) (thanks to Emil Kantis)
• Add value class support to the ProtoBufSchemaGenerator (#​2542) (thanks to Felipe Rotilho)

Bugfixes and improvements

• Fix: Hocon polymorphic serialization in containers (#​2151) (thanks to LichtHund)
• Actualize lenient mode documentation (#​2568)
• Slightly improve error messages thrown from serializer() function (#​2533)
• Do not try to coerce input values for properties (#​2530)
• Make empty objects and arrays collapsed in pretty print mode (#​2506)
• Update Gradle dokka configuration to make sure "source" button is visible in all API docs (#​2518, #​2524)

v1.6.2

==================

This is a patch release accompanying Kotlin 1.9.21. It also provides additional targets that were not available in 1.6.1:
wasm-wasi and (deprecated) linuxArm32Hfp.

• Add Wasm WASI target (#​2510)
• Bring back linuxArm32Hfp target because it is deprecated, but not removed yet. (#​2505)

v1.6.1

==================

This release uses Kotlin 1.9.20 by default, while upcoming 1.9.21 is also supported.

Trailing commas in Json

Trailing commas are one of the most popular non-spec Json variations.
A new configuration flag, allowTrailingComma, makes Json parser accept them instead of throwing an exception.
Note that it does not affect encoding, so kotlinx.serialization always produces Json without trailing commas.
See details in the corresponding PR

Support of WasmJs target

Kotlin/Wasm has been experimental for some time and gained enough maturity to be added to the kotlinx libraries.
Starting with 1.6.1, kotlinx.serialization provides a wasm-js flavor, so your projects with Kotlin/Wasm can have even more
functionality.
As usual, just add serialization dependencies to your build
and declare wasmJs target.
Please remember that Kotlin/Wasm is still experimental, so changes are expected.

Bugfixes and improvements

• Fix TaggedDecoder nullable decoding (#​2456) (thanks to Phillip Schichtel)
• Fix IllegalAccessException for some JPMS boundaries (#​2469)
• Cbor: check if inline value classes are marked as @​ByteString (#​2466) (thanks to eater)
• Improve polymorphic deserialization optimization (#​2481)
• Update Okio dependency to 3.6.0 (#​2473)
• Add protobuf conformance tests (#​2404) (thanks to Doğaç Eldenk)
• Support decoding maps with boolean keys (#​2440)

v1.6.0

==================

This release contains all features and bugfixes from 1.6.0-RC plus some bugfixes on its own (see below).
Kotlin 1.9.0 is used as a default, while 1.9.10 is also supported.

Bugfixes

• Improve error messages from Json parser (#​2406)
• Mark @​SerialName, @​Required and @​Transient with @​MustBeDocumented (#​2407)
• Ensure that no additional files except java compiler output get into multi-release jar (#​2405)
• Fix enums with negative numbers in protobuf not serializing & de-serializing (#​2400) (thanks to Doğaç Eldenk)

v1.5.1

==================
This release contains an important Native targets overhaul, as well as numerous enhancements and bugfixes.
Kotlin 1.8.21 is used by default.

New set of Native targets

The official Kotlin target support policy has recently been published
describing new target policy: each target belongs to a certain tier, and different tiers have different stability guarantees.
The official recommendation for library authors is to support targets up to Tier 3,
and kotlinx.serialization now follows it.
It means that in this release, there are a lot of new targets added from this tier,
such as androidNativeX86 or watchosDeviceArm64.
Note that since they belong to Tier 3, they're not auto-tested on CI.

kotlinx.serialization also ships some deprecated Kotlin/Native targets that do not belong to any tier (e.g. iosArm32, mingwX86).
We'll continue to release them, but we do not provide support for them, nor do we plan to add new targets from the deprecated list.

Improvements in Json elements

There are two new function sets that should make creating raw Json elements easier.
First one contains overloads for JsonPrimitive constructor-like function
that accept unsigned types: JsonPrimitive(1u).
Second one adds new addAll functions to JsonArrayBuilder to be used with collections
of numbers, booleans or strings: buildJsonArray { addAll(listOf(1, 2, 3)) }
Both were contributed to us by aSemy.

Other enhancements

• Potential source-breaking change: Rename json-okio target variables to sink (#​2226)
• Function to retrieve KSerializer by KClass and type arguments serializers (#​2291)
• Added FormatLanguage annotation to Json methods (#​2234)
• Properties Format: Support sealed/polymorphic classes as class properties (#​2255)

Bugfixes

• KeyValueSerializer: Fix missing call to endStructure() (#​2272)
• ObjectSerializer: Respect sequential decoding (#​2273)
• Fix value class encoding in various corner cases (#​2242)
• Fix incorrect json decoding iterator's .hasNext() behavior on array-wrapped inputs (#​2268)
• Fix memory leak caused by invalid KTypeWrapper's equals method (#​2274)
• Fixed NoSuchMethodError when parsing a JSON stream on Java 8 (#​2219)
• Fix MissingFieldException duplication (#​2213)

v1.5.0

==================

This release contains all features and bugfixes from 1.5.0-RC plus some experimental features and bugfixes on its own (see below).
Kotlin 1.8.10 is used as a default.

HoconEncoder and HoconDecoder interfaces and HOCON-specific serializers

These interfaces work in a way similar to JsonEncoder and JsonDecoder: they allow intercepting (de)serialization process,
making writing if custom HOCON-specific serializers easier. New ConfigMemorySizeSerializer and JavaDurationSerializer already make use of them.
See more details in the PR.
Big thanks to Alexander Mikhailov for contributing this!

Ability to read buffered huge strings in custom Json deserializers

New interface ChunkedDecoder allows you to read huge strings that may not fit in memory by chunks.
Currently, this interface is only implemented by Json decoder that works with strings and streams,
but we may expand it later, if there's a demand for it.
See more details in the PR authored by Alexey Sviridov.

Bugfixes

• Improve runtime exceptions messages (#​2180)
• Added support for null values for nullable enums in lenient mode (#​2176)
• Prevent class loaders from leaking when using ClassValue cache (#​2175)

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[TWiStErRob]

@chao2zhang @cortinico is it going to be a problem to upgrade this and then use it in Detekt? It would expose as transitive dependency.

[cortinico]

It would expose as transitive dependency.

Not for our users though right? 🤔 I see no problem in bumping this but maybe I'm missing something

[TWiStErRob]

Depends on who you count as a "user". If anyone who applies the Gradle plugin, then they will be affected:

+--- io.gitlab.arturbosch.detekt:detekt-gradle-plugin:1.22.0
|    \--- io.github.detekt.sarif4k:sarif4k:0.0.1
|         +--- org.jetbrains.kotlinx:kotlinx-serialization-json:1.1.0
|         |    \--- org.jetbrains.kotlinx:kotlinx-serialization-json-jvm:1.1.0
|         |         +--- org.jetbrains.kotlin:kotlin-stdlib:1.4.30 -> 1.8.10 (*)
|         |         +--- org.jetbrains.kotlin:kotlin-stdlib-common:1.4.30 -> 1.8.10
|         |         \--- org.jetbrains.kotlinx:kotlinx-serialization-core:1.1.0
|         |              \--- org.jetbrains.kotlinx:kotlinx-serialization-core-jvm:1.1.0
|         |                   +--- org.jetbrains.kotlin:kotlin-stdlib:1.4.30 -> 1.8.10 (*)
|         |                   \--- org.jetbrains.kotlin:kotlin-stdlib-common:1.4.30 -> 1.8.10
|         \--- org.jetbrains.kotlin:kotlin-stdlib:1.4.31 -> 1.8.10 (*)

This applies to classpath, plugins { } or includeBuild + implementation/api uses, and ever for plugins that configure Detekt as per a user's convention. The ->s in the above code are because I'm using KGP 1.8.10.

AGP, KGP and any other plugin could be using the same, if we use the latest Gradle will resolve the latest. Which may be fine, just be aware 😁.

Note: https://github.com/Kotlin/kotlinx.serialization/blob/master/docs/compatibility.md#compatibility-with-kotlin-compiler-plugin, which is promising, because it looks very similar to Kotlin's.

[cortinico]

Depends on who you count as a "user". If anyone who applies the Gradle plugin, then they will be affected:

Oh yeah this can be a problem.

From what I can see, we use sarif4k inside DGP only here:
https://github.com/detekt/detekt/blob/4719e71bbddad8934b7641abd574b286c1718a32/detekt-gradle-plugin/src/main/kotlin/io/gitlab/arturbosch/detekt/report/SarifReportMerger.kt#L3

IMHO We should be able to perform that JSON merging task without having to rely on a implementation or sarif4k (or kotlinx.serialization) which introduces those transitive dependencies.

Especially also considered that we have a compileOnly dep on KGP:
https://github.com/detekt/detekt/blob/4719e71bbddad8934b7641abd574b286c1718a32/detekt-gradle-plugin/build.gradle.kts#L69

[chao2zhang]

Is the remaining action that we should refactor DGP off Sarif4k so that

• Respecting KGP compileOnly dependency
• Not exposing transitive dependency when our client/users depends on KGP