Update dependency org.jetbrains.kotlinx:kotlinx-serialization-json to v1.6.3

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
org.jetbrains.kotlinx:kotlinx-serialization-json	1.4.1 -> 1.6.3

---

Release Notes

Kotlin/kotlinx.serialization (org.jetbrains.kotlinx:kotlinx-serialization-json)

v1.6.3

==================

This release provides a couple of new features and uses Kotlin 1.9.22 as default.

Class discriminator output mode

Class discriminator provides information for serializing and deserializing polymorphic class hierarchies.
In case you want to encode more or less information for various third party APIs about types in the output, it is possible to control
addition of the class discriminator with the JsonBuilder.classDiscriminatorMode property.
For example, ClassDiscriminatorMode.NONE does not add class discriminator at all, in case the receiving party is not interested in Kotlin types.
You can learn more about this feature in the documentation and corresponding PR.

Other features

• Add kebab-case naming strategy (#​2531) (thanks to Emil Kantis)
• Add value class support to the ProtoBufSchemaGenerator (#​2542) (thanks to Felipe Rotilho)

Bugfixes and improvements

• Fix: Hocon polymorphic serialization in containers (#​2151) (thanks to LichtHund)
• Actualize lenient mode documentation (#​2568)
• Slightly improve error messages thrown from serializer() function (#​2533)
• Do not try to coerce input values for properties (#​2530)
• Make empty objects and arrays collapsed in pretty print mode (#​2506)
• Update Gradle dokka configuration to make sure "source" button is visible in all API docs (#​2518, #​2524)

v1.6.2

v1.6.1

==================

This release uses Kotlin 1.9.20 by default, while upcoming 1.9.21 is also supported.

Trailing commas in Json

Trailing commas are one of the most popular non-spec Json variations.
A new configuration flag, allowTrailingComma, makes Json parser accept them instead of throwing an exception.
Note that it does not affect encoding, so kotlinx.serialization always produces Json without trailing commas.
See details in the corresponding PR

Support of WasmJs target

Kotlin/Wasm has been experimental for some time and gained enough maturity to be added to the kotlinx libraries.
Starting with 1.6.1, kotlinx.serialization provides a wasm-js flavor, so your projects with Kotlin/Wasm can have even more
functionality.
As usual, just add serialization dependencies to your build
and declare wasmJs target.
Please remember that Kotlin/Wasm is still experimental, so changes are expected.

Bugfixes and improvements

• Fix TaggedDecoder nullable decoding (#​2456) (thanks to Phillip Schichtel)
• Fix IllegalAccessException for some JPMS boundaries (#​2469)
• Cbor: check if inline value classes are marked as @​ByteString (#​2466) (thanks to eater)
• Improve polymorphic deserialization optimization (#​2481)
• Update Okio dependency to 3.6.0 (#​2473)
• Add protobuf conformance tests (#​2404) (thanks to Doğaç Eldenk)
• Support decoding maps with boolean keys (#​2440)

v1.6.0

==================

This release contains all features and bugfixes from 1.6.0-RC plus some bugfixes on its own (see below).
Kotlin 1.9.0 is used as a default, while 1.9.10 is also supported.

Bugfixes

• Improve error messages from Json parser (#​2406)
• Mark @​SerialName, @​Required and @​Transient with @​MustBeDocumented (#​2407)
• Ensure that no additional files except java compiler output get into multi-release jar (#​2405)
• Fix enums with negative numbers in protobuf not serializing & de-serializing (#​2400) (thanks to Doğaç Eldenk)

v1.5.1

==================
This release contains an important Native targets overhaul, as well as numerous enhancements and bugfixes.
Kotlin 1.8.21 is used by default.

New set of Native targets

The official Kotlin target support policy has recently been published
describing new target policy: each target belongs to a certain tier, and different tiers have different stability guarantees.
The official recommendation for library authors is to support targets up to Tier 3,
and kotlinx.serialization now follows it.
It means that in this release, there are a lot of new targets added from this tier,
such as androidNativeX86 or watchosDeviceArm64.
Note that since they belong to Tier 3, they're not auto-tested on CI.

kotlinx.serialization also ships some deprecated Kotlin/Native targets that do not belong to any tier (e.g. iosArm32, mingwX86).
We'll continue to release them, but we do not provide support for them, nor do we plan to add new targets from the deprecated list.

Improvements in Json elements

There are two new function sets that should make creating raw Json elements easier.
First one contains overloads for JsonPrimitive constructor-like function
that accept unsigned types: JsonPrimitive(1u).
Second one adds new addAll functions to JsonArrayBuilder to be used with collections
of numbers, booleans or strings: buildJsonArray { addAll(listOf(1, 2, 3)) }
Both were contributed to us by aSemy.

Other enhancements

• Potential source-breaking change: Rename json-okio target variables to sink (#​2226)
• Function to retrieve KSerializer by KClass and type arguments serializers (#​2291)
• Added FormatLanguage annotation to Json methods (#​2234)
• Properties Format: Support sealed/polymorphic classes as class properties (#​2255)

Bugfixes

• KeyValueSerializer: Fix missing call to endStructure() (#​2272)
• ObjectSerializer: Respect sequential decoding (#​2273)
• Fix value class encoding in various corner cases (#​2242)
• Fix incorrect json decoding iterator's .hasNext() behavior on array-wrapped inputs (#​2268)
• Fix memory leak caused by invalid KTypeWrapper's equals method (#​2274)
• Fixed NoSuchMethodError when parsing a JSON stream on Java 8 (#​2219)
• Fix MissingFieldException duplication (#​2213)

v1.5.0

==================

This release contains all features and bugfixes from 1.5.0-RC plus some experimental features and bugfixes on its own (see below).
Kotlin 1.8.10 is used as a default.

HoconEncoder and HoconDecoder interfaces and HOCON-specific serializers

These interfaces work in a way similar to JsonEncoder and JsonDecoder: they allow intercepting (de)serialization process,
making writing if custom HOCON-specific serializers easier. New ConfigMemorySizeSerializer and JavaDurationSerializer already make use of them.
See more details in the PR.
Big thanks to Alexander Mikhailov for contributing this!

Ability to read buffered huge strings in custom Json deserializers

New interface ChunkedDecoder allows you to read huge strings that may not fit in memory by chunks.
Currently, this interface is only implemented by Json decoder that works with strings and streams,
but we may expand it later, if there's a demand for it.
See more details in the PR authored by Alexey Sviridov.

Bugfixes

• Improve runtime exceptions messages (#​2180)
• Added support for null values for nullable enums in lenient mode (#​2176)
• Prevent class loaders from leaking when using ClassValue cache (#​2175)

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.

[TWiStErRob]

@chao2zhang @cortinico is it going to be a problem to upgrade this and then use it in Detekt? It would expose as transitive dependency.

[cortinico]

It would expose as transitive dependency.

Not for our users though right? 🤔 I see no problem in bumping this but maybe I'm missing something

[TWiStErRob]

Depends on who you count as a "user". If anyone who applies the Gradle plugin, then they will be affected:

+--- io.gitlab.arturbosch.detekt:detekt-gradle-plugin:1.22.0
|    \--- io.github.detekt.sarif4k:sarif4k:0.0.1
|         +--- org.jetbrains.kotlinx:kotlinx-serialization-json:1.1.0
|         |    \--- org.jetbrains.kotlinx:kotlinx-serialization-json-jvm:1.1.0
|         |         +--- org.jetbrains.kotlin:kotlin-stdlib:1.4.30 -> 1.8.10 (*)
|         |         +--- org.jetbrains.kotlin:kotlin-stdlib-common:1.4.30 -> 1.8.10
|         |         \--- org.jetbrains.kotlinx:kotlinx-serialization-core:1.1.0
|         |              \--- org.jetbrains.kotlinx:kotlinx-serialization-core-jvm:1.1.0
|         |                   +--- org.jetbrains.kotlin:kotlin-stdlib:1.4.30 -> 1.8.10 (*)
|         |                   \--- org.jetbrains.kotlin:kotlin-stdlib-common:1.4.30 -> 1.8.10
|         \--- org.jetbrains.kotlin:kotlin-stdlib:1.4.31 -> 1.8.10 (*)

This applies to classpath, plugins { } or includeBuild + implementation/api uses, and ever for plugins that configure Detekt as per a user's convention. The ->s in the above code are because I'm using KGP 1.8.10.

AGP, KGP and any other plugin could be using the same, if we use the latest Gradle will resolve the latest. Which may be fine, just be aware 😁.

Note: https://github.com/Kotlin/kotlinx.serialization/blob/master/docs/compatibility.md#compatibility-with-kotlin-compiler-plugin, which is promising, because it looks very similar to Kotlin's.

[cortinico]

Depends on who you count as a "user". If anyone who applies the Gradle plugin, then they will be affected:

Oh yeah this can be a problem.

From what I can see, we use sarif4k inside DGP only here:
https://github.com/detekt/detekt/blob/4719e71bbddad8934b7641abd574b286c1718a32/detekt-gradle-plugin/src/main/kotlin/io/gitlab/arturbosch/detekt/report/SarifReportMerger.kt#L3

IMHO We should be able to perform that JSON merging task without having to rely on a implementation or sarif4k (or kotlinx.serialization) which introduces those transitive dependencies.

Especially also considered that we have a compileOnly dep on KGP:
https://github.com/detekt/detekt/blob/4719e71bbddad8934b7641abd574b286c1718a32/detekt-gradle-plugin/build.gradle.kts#L69

[chao2zhang]

Is the remaining action that we should refactor DGP off Sarif4k so that

• Respecting KGP compileOnly dependency
• Not exposing transitive dependency when our client/users depends on KGP