[dependabot]

Bumps essenty from 2.5.0 to 2.6.0.
Updates com.arkivanov.essenty:lifecycle from 2.5.0 to 2.6.0

Release notes

Sourced from com.arkivanov.essenty:lifecycle's releases.

2.6.0

What's Changed

Library

• Deprecated InstanceKeeper extensions without the key parameter by @​arkivanov in arkivanov/Essenty#193
• Removed useless reified keywords from InstanceKeeper extensions by @​arkivanov in arkivanov/Essenty#194
• Added property delegates for InstanceKeeper by @​arkivanov in arkivanov/Essenty#195
• Updated Kotlin to 2.3.21, AGP to 8.13.2 and Gradle to 8.13 by @​arkivanov in arkivanov/Essenty#200

Misc

• Fix documentation typo by @​latent-9 in arkivanov/Essenty#199

Versions and dependencies

Kotlin: 2.3.21 kotlinx-serialization: 1.6.3

Module lifecycle-coroutines

kotlinx-coroutines: 1.9.0

Module lifecycle-reaktive

Reaktive: 2.1.0

New Contributors

• @​latent-9 made their first contribution in arkivanov/Essenty#199

Full Changelog: arkivanov/Essenty@2.5.0...2.6.0

Commits

• c4f1e91 Migrated to Portal OSSRH Staging API
• 336d784 Update publish.yml
• f00af0b Bumped version to 2.6.0
• 48ac5f9 Merge pull request #200 from arkivanov/kotlin-2.3.21
• 64a6a1c Updated Kotlin to 2.3.21, AGP to 8.13.2 and Gradle to 8.13
• d3ca4db Merge pull request #199 from latent-9/fix-doc-typos
• 9156ae1 Fix documentation typo
• 26ea8ff Update README.md
• 703543d Update FUNDING.yml
• 1d0ba90 Merge pull request #195 from arkivanov/retainingInstance
• Additional commits viewable in compare view

Updates com.arkivanov.essenty:state-keeper from 2.5.0 to 2.6.0

Release notes

Sourced from com.arkivanov.essenty:state-keeper's releases.

2.6.0

What's Changed

Library

• Deprecated InstanceKeeper extensions without the key parameter by @​arkivanov in arkivanov/Essenty#193
• Removed useless reified keywords from InstanceKeeper extensions by @​arkivanov in arkivanov/Essenty#194
• Added property delegates for InstanceKeeper by @​arkivanov in arkivanov/Essenty#195
• Updated Kotlin to 2.3.21, AGP to 8.13.2 and Gradle to 8.13 by @​arkivanov in arkivanov/Essenty#200

Misc

• Fix documentation typo by @​latent-9 in arkivanov/Essenty#199

Versions and dependencies

Kotlin: 2.3.21 kotlinx-serialization: 1.6.3

Module lifecycle-coroutines

kotlinx-coroutines: 1.9.0

Module lifecycle-reaktive

Reaktive: 2.1.0

New Contributors

• @​latent-9 made their first contribution in arkivanov/Essenty#199

Full Changelog: arkivanov/Essenty@2.5.0...2.6.0

Commits

• c4f1e91 Migrated to Portal OSSRH Staging API
• 336d784 Update publish.yml
• f00af0b Bumped version to 2.6.0
• 48ac5f9 Merge pull request #200 from arkivanov/kotlin-2.3.21
• 64a6a1c Updated Kotlin to 2.3.21, AGP to 8.13.2 and Gradle to 8.13
• d3ca4db Merge pull request #199 from latent-9/fix-doc-typos
• 9156ae1 Fix documentation typo
• 26ea8ff Update README.md
• 703543d Update FUNDING.yml
• 1d0ba90 Merge pull request #195 from arkivanov/retainingInstance
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[kshivang]

@claude Please review this dependency update against current dev for substantive compatibility, security and regression issues. Check version constraints, Kotlin/Compose alignment, native classifiers where applicable, and CI coverage.

[claude]

Claude finished @kshivang's task in 4m 49s —— View job

---

Review: essenty 2.5.0 → 2.6.0

• Gather context (diff vs origin/dev, version catalog)
• Check version constraints and Decompose/essenty alignment
• Check Kotlin/Compose alignment and native classifiers
• Check for deprecated InstanceKeeper API usage in-tree
• Check CI coverage and publish/POM impact
• Post review

Verdict: safe to merge. Against current dev this is exactly one line (git diff origin/dev HEAD -- gradle/libs.versions.toml shows only essenty = "2.5.0" → "2.6.0"; no catalog divergence), the release is additive plus deprecations, and none of what 2.6.0 changed is used here. Two optional follow-ups below, one of them worth doing.

---

1. The blast radius is larger than the diff, and this line does not say so

com.arkivanov.essenty. is in PluginClassLoader.defaultSharedPackages (plugin-platform/plugin-loader/src/desktopMain/kotlin/ai/rever/boss/plugin/loader/PluginClassLoader.kt:202), so it is loaded parent-first: this pin is the essenty every installed plugin gets at runtime, whatever its jar bundles. That is the same property the catalog documents at length for kotlinx-serialization (libs.versions.toml:20-27) and for ktor/decompose, and the essenty line at :13 carries no such note.

Practical risk is low and one-directional: a plugin compiled against 2.5.0 runs fine on a 2.6.0 host (superset). The direction that breaks is a plugin adopting 2.6.0-only API (the new InstanceKeeper property delegates) and then running on an older host, which is a boss_plugins-side concern, not a reason to hold this PR. Worth a comment so the next automated bump is read as cross-repo rather than trivial. Fix this →

2. Nothing 2.6.0 changed is used in this tree

The repo's entire essenty surface is Lifecycle, LifecycleRegistry, doOnCreate, doOnDestroy, destroy, resume - PanelComponentStore.kt:9-12, BossMainWindowPanel.kt:135-137, and three desktopTests. There are zero com.arkivanov.essenty.statekeeper / .instancekeeper / .backhandler imports anywhere, so:

• the deprecated no-key InstanceKeeper extensions: not used;
• the reified removal: not reachable, and in any case removing reified from an inline extension does not move the erased JVM signature, so already-compiled Decompose code keeps linking;
• the new property delegates: additive.

Every getOrCreate* hit in the tree is the repo's own PanelComponentStore.getOrCreateComponent, unrelated to essenty. And there is no allWarningsAsErrors anywhere in the build, so a new deprecation warning could not fail the build even if one appeared.

3. Decompose alignment: inferred, not verified (no network in this runner)

decompose = "3.5.0" stays put and declares its own essenty requirement; Gradle resolves to the higher version, so this pin now wins over whatever 3.5.0 asks for. I could not read decompose-jvm-3.5.0.pom (no network, no Gradle cache here), so I am relying on the release being an additive minor plus the green run. Two things already cover it: the code-quality job runs ./gradlew :composeApp:dependencies (build.yml:328), so the resolved constraint is visible in the passing run, and 2.6.0 removed no API.

The durable fix is to stop the two arriving in separate PRs at all - same author, same release cadence, and essenty is Decompose's own dependency. .github/dependabot.yml has no groups: block today:

    groups:
      arkivanov:
        patterns:
          - "com.arkivanov.decompose:*"
          - "com.arkivanov.essenty:*"

Fix this →

4. Kotlin / Compose alignment: fine

essenty 2.6.0 is built with Kotlin 2.3.21; the host is on kotlin = "2.4.10" (:16). Newer compilers read older metadata, not the reverse, so 2.3.21-produced metadata is consumable. Compose is not involved: lifecycle and state-keeper carry no Compose dependency (the Compose-facing half is decompose:extensions-compose, unmoved), so compose-multiplatform = "1.12.0" and the composeCompiler plugin version are untouched.

One eyebrow, no action: 2.6.0's notes declare kotlinx-serialization 1.6.3 for state-keeper while the host pins 1.11.0 and shares it parent-first. Gradle resolves up to 1.11.0, 2.5.0 sat in the same position, and this PR does not move that line.

5. Native classifiers: N/A

Every relevant module is JVM-only (composeApp/build.gradle.kts:868 and plugin-api-core/build.gradle.kts:102 both declare jvm("desktop") and nothing else), so resolution takes the *-jvm variants and no klib or native-classifier artifacts enter the graph. Nothing to change.

6. No published POM gains a 2.6.0 requirement

Only three places declare essenty: plugin-api-core (api(libs.essenty.lifecycle), line 136), plugin-sandbox (implementation, line 42), and composeApp (lines 963-964). None appears in publish-maven-central.yml's package list (workspace-types, bookmark-types, api-browser, plugin-api, logging, ui-core, scrollbar), so nothing on Central picks up a 2.6.0 constraint and AGENTS.md's "publish the sibling type modules together" trap is not triggered.

Unrelated pre-existing oddity spotted while checking this: publish-maven-central.yml:65 runs :plugin-platform:plugin-api:publishAndReleaseToMavenCentral, but there is no plugin-platform/plugin-api directory in the tree. Not this PR's business, noting it only because I hit it.

7. Security / supply chain

Minor bump of a small Apache-2.0 library by the Decompose author; no known advisories, and lifecycle/state-keeper expose no network or untrusted-input parsing surface. The 2.6.0 tag includes a publishing-infra change ("Migrated to Portal OSSRH Staging API") on the same groupId and coordinates, so nothing changes for consumers. There is no gradle/verification-metadata.xml and no dependency lockfile in the repo, so there is nothing to regenerate - and equally no checksum pinning, which is a standing observation about the repo rather than a defect in this PR.

8. CI coverage: adequate, with one subtlety

The PR targets dev and build.yml runs on pull_request: [main, dev], so the full ubuntu/macos/windows matrix fired and 🔨 Build & Test is green (run 34828447067) - which means 2.6.0 resolved from Central and compiled on all three.

The subtlety: the three tests that actually exercise essenty lifecycle (PanelComponentStoreResetTest, BossTabsComponentMoveTest, BossTabsComponentReopenTest) live in composeApp desktopTest, and the 🧪 Run Tests step's bare ./gradlew test does not reach them - a jvm("desktop") target registers desktopTest, not test, exactly as AGENTS.md records. They are covered by the next step's ./gradlew build -PskipLint via check → allTests. So the coverage exists; it just does not come from the step named "Run Tests".

Branch freshness: the branch and dev share no history in this shallow checkout and dev's head (3e09b57) is not an ancestor, so the green run was produced on an older base. Content is clean (the catalog diff vs dev is exactly the one line), but let CI re-run if the merge queue rebases rather than trusting this run.

---

No changes pushed - this was a review only. I could not run Gradle locally (no network for dependency resolution in this environment), so the compile/test evidence is the passing CI run rather than a local build.
| Branch: dependabot/gradle/essenty-2.6.0

[kshivang]

Review resolution and validation

Verified Decompose 3.5.0 published module metadata requires Essenty 2.5.0, while Essenty 2.6.0 uses Kotlin 2.3.21 metadata readable by host Kotlin 2.4.x. Its lifecycle/state-keeper API change is compatible; instance-keeper delegates are additive and no-key extensions are deprecated, not removed. Parent-first Essenty sharing was checked against plugin consumers. The existing serialization 1.11.0 override remains unchanged. Claude grouping/catalog-comment suggestions are optional future maintenance, not a reason to combine this distinct update with Kotlin.

Original work remains entirely Dependabot-authored; no source repairs for this PR. The initial head passed all ten CI checks, including all three platform builds, quality and compatibility. Local isolated integration 90902cd81 on dev 3e09b57 plus the four distinct dependency updates passed 4,685 desktop tests (one skipped) and 49 IPC tests. After dev advanced to 2714a6a through #648, #509 and #646, a second isolated run passed their focused regressions, Essenty lifecycle tests and the logging/bookmark/workspace Compose stable-field tests on combined tree e6e51b455. No conflict or dependency catalog change was introduced by those merges. Bot contribution score: N/A. No application or database deployment was run.