build(deps): bump koin from 3.3.3 to 4.2.2

[dependabot]

Bumps koin from 3.3.3 to 4.2.2.
Updates io.insert-koin:koin-android from 3.3.3 to 4.2.2

Release notes

Sourced from io.insert-koin:koin-android's releases.

Koin 4.2.2

Maintenance release for the 4.2.x line — resolver regression fixes from the 4.2.0 CoreResolverV2 rewrite, ViewModel/scope fixes, a Ktor request-scope fix, plus new tvOS support and an R8/ProGuard guide.

Anyone hitting resolver issues on 4.2.0/4.2.1 should upgrade to 4.2.2.

Bug Fixes

• Stacked params no longer shadow qualified dependencies (#2370, #2408) — A value passed via parametersOf could be returned for a get(named(...)) request of the same type, shadowing the qualified definition. Qualified lookups are now registry-only and never read the parameter stack — parameters carry no qualifier, so they can't satisfy a qualified request.

• Root factory no longer resolves its scoped dependencies from _root_ (#2379) — When a non-single factory defined in the root scope was resolved from a child scope, CoreResolverV2 resolved its scoped dependencies against _root_ instead of the requesting scope. Linked-scope resolution now runs the factory against the requesting scope (single instances keep their root-bound semantics, preserving #2325).

• viewModelScopeFactory scope is linked to its parent (#2299) — A ViewModel scope created via viewModelScopeFactory() was not linked to the originating scope, so dependencies declared in the parent couldn't be resolved. The created scope is now linked to its parent (except when the parent is root).

• Tolerate non-String environment properties (#2348) — Loading environment/system properties whose values aren't String threw ClassCastException due to an unchecked map cast. Non-String values are now preserved as Any and only String keys are required.

• Unique Ktor request-scope ids under concurrency (#2410) — Concurrent requests could collide on request-scope ids. Ids are now generated from a monotonic counter seeded once at startup. Thanks @​lfavreli-betclic!

• Actionable errors for SavedStateHandle / viewModelScope { } (#2044, #2417) — Resolving SavedStateHandle without the proper extras, or using viewModelScope { } without the viewModelScopeFactory() option, now produces a clear, actionable error message instead of an opaque failure.

Added

• tvOS targets for koin-core-viewmodel (#2426) — koin-core-viewmodel now publishes tvosArm64, tvosX64, and tvosSimulatorArm64, unblocking ViewModel usage on tvOS.

• Consumer R8/ProGuard rules + guide — Android and ViewModel artifacts now ship consumer R8/ProGuard rules in their AARs, and a new R8 / ProGuard guide documents keep rules for minified builds.

Improvements

• O(1) secondary-type registration in bind() / binds() — bind/binds now append secondary types in O(1) instead of reallocating the type list per binding, removing quadratic cost when a definition declares many bindings. No user-visible behavior change.

Documentation

• Navigation 3 typed entryProvider (#2336) — Added guidance on using Koin with the typed entryProvider in the Navigation 3 reference.

Contributors

Thanks to the following contributors for this release:

• @​arnaudgiuliani (Arnaud Giuliani)
• @​lfavreli-betclic (Loïc Favrelière) — unique Ktor request-scope ids under concurrency (#2432)

Koin 4.2.1

Support for Compile Safety with Koin Compiler 1.0.0-RC1

• Koin Compiler Plugin 1.0.0-RC1 - https://github.com/InsertKoinIO/koin-compiler-plugin/releases/tag/1.0.0-RC1

Bug Fixes

• Fix stacked-params lookup on linked scopes (#2387) — The 4.2.0 resolver rewrite (CoreResolverV2) walked linked scopes but dropped the per-parent stacked-parameters check that 4.1.x performed via recursion. This broke patterns where AndroidParametersHolder is stacked on the factory scope by KoinViewModelFactory and SavedStateHandle is then resolved from a child ViewModel scope. Linked-scope resolution now also checks stacked params on each parent scope.

• Restore ABI compatibility for runOnKoinStarted (#2391) — The 4.2.0 release inadvertently broke binary compatibility for runOnKoinStarted on JVM. Fixed by restoring the original JVM class name via @JvmName/@JvmMultifileClass annotations.

... (truncated)

Commits

• dc86ef8 Merge pull request #2448 from InsertKoinIO/release/4.2.2-finalize
• 376ba1c Finalize 4.2.2: version 4.2.2 + nav3 typed entryProvider docs (#2336)
• 0029f34 Merge pull request #2446 from InsertKoinIO/fix/2348-env-properties-cast
• 26020e8 Fix #2348 - tolerate non-String environment properties (ClassCastException)
• fff5291 Merge pull request #2432 from lfavreli-betclic/fix/2410-request-scope-atomic-id
• 961521c Merge pull request #2444 from InsertKoinIO/fix/2299-vmscope-link-parent
• 524eb25 Fix #2299 - link viewModelScopeFactory scope to its parent scope
• 8b99903 Merge pull request #2443 from InsertKoinIO/docs/2417b-viewmodelscope-option
• 7bb09d3 Docs: viewModelScope { } requires viewModelScopeFactory() option (#2417)
• 931132e Merge pull request #2442 from InsertKoinIO/fix/2426-tvos-viewmodel-targets
• Additional commits viewable in compare view

Updates io.insert-koin:koin-androidx-workmanager from 3.3.3 to 4.2.2

Release notes

Sourced from io.insert-koin:koin-androidx-workmanager's releases.

Koin 4.2.2

Maintenance release for the 4.2.x line — resolver regression fixes from the 4.2.0 CoreResolverV2 rewrite, ViewModel/scope fixes, a Ktor request-scope fix, plus new tvOS support and an R8/ProGuard guide.

Anyone hitting resolver issues on 4.2.0/4.2.1 should upgrade to 4.2.2.

Bug Fixes

• Stacked params no longer shadow qualified dependencies (#2370, #2408) — A value passed via parametersOf could be returned for a get(named(...)) request of the same type, shadowing the qualified definition. Qualified lookups are now registry-only and never read the parameter stack — parameters carry no qualifier, so they can't satisfy a qualified request.

• Root factory no longer resolves its scoped dependencies from _root_ (#2379) — When a non-single factory defined in the root scope was resolved from a child scope, CoreResolverV2 resolved its scoped dependencies against _root_ instead of the requesting scope. Linked-scope resolution now runs the factory against the requesting scope (single instances keep their root-bound semantics, preserving #2325).

• viewModelScopeFactory scope is linked to its parent (#2299) — A ViewModel scope created via viewModelScopeFactory() was not linked to the originating scope, so dependencies declared in the parent couldn't be resolved. The created scope is now linked to its parent (except when the parent is root).

• Tolerate non-String environment properties (#2348) — Loading environment/system properties whose values aren't String threw ClassCastException due to an unchecked map cast. Non-String values are now preserved as Any and only String keys are required.

• Unique Ktor request-scope ids under concurrency (#2410) — Concurrent requests could collide on request-scope ids. Ids are now generated from a monotonic counter seeded once at startup. Thanks @​lfavreli-betclic!

• Actionable errors for SavedStateHandle / viewModelScope { } (#2044, #2417) — Resolving SavedStateHandle without the proper extras, or using viewModelScope { } without the viewModelScopeFactory() option, now produces a clear, actionable error message instead of an opaque failure.

Added

• tvOS targets for koin-core-viewmodel (#2426) — koin-core-viewmodel now publishes tvosArm64, tvosX64, and tvosSimulatorArm64, unblocking ViewModel usage on tvOS.

• Consumer R8/ProGuard rules + guide — Android and ViewModel artifacts now ship consumer R8/ProGuard rules in their AARs, and a new R8 / ProGuard guide documents keep rules for minified builds.

Improvements

• O(1) secondary-type registration in bind() / binds() — bind/binds now append secondary types in O(1) instead of reallocating the type list per binding, removing quadratic cost when a definition declares many bindings. No user-visible behavior change.

Documentation

• Navigation 3 typed entryProvider (#2336) — Added guidance on using Koin with the typed entryProvider in the Navigation 3 reference.

Contributors

Thanks to the following contributors for this release:

• @​arnaudgiuliani (Arnaud Giuliani)
• @​lfavreli-betclic (Loïc Favrelière) — unique Ktor request-scope ids under concurrency (#2432)

Koin 4.2.1

Support for Compile Safety with Koin Compiler 1.0.0-RC1

• Koin Compiler Plugin 1.0.0-RC1 - https://github.com/InsertKoinIO/koin-compiler-plugin/releases/tag/1.0.0-RC1

Bug Fixes

• Fix stacked-params lookup on linked scopes (#2387) — The 4.2.0 resolver rewrite (CoreResolverV2) walked linked scopes but dropped the per-parent stacked-parameters check that 4.1.x performed via recursion. This broke patterns where AndroidParametersHolder is stacked on the factory scope by KoinViewModelFactory and SavedStateHandle is then resolved from a child ViewModel scope. Linked-scope resolution now also checks stacked params on each parent scope.

• Restore ABI compatibility for runOnKoinStarted (#2391) — The 4.2.0 release inadvertently broke binary compatibility for runOnKoinStarted on JVM. Fixed by restoring the original JVM class name via @JvmName/@JvmMultifileClass annotations.

... (truncated)

Commits

• dc86ef8 Merge pull request #2448 from InsertKoinIO/release/4.2.2-finalize
• 376ba1c Finalize 4.2.2: version 4.2.2 + nav3 typed entryProvider docs (#2336)
• 0029f34 Merge pull request #2446 from InsertKoinIO/fix/2348-env-properties-cast
• 26020e8 Fix #2348 - tolerate non-String environment properties (ClassCastException)
• fff5291 Merge pull request #2432 from lfavreli-betclic/fix/2410-request-scope-atomic-id
• 961521c Merge pull request #2444 from InsertKoinIO/fix/2299-vmscope-link-parent
• 524eb25 Fix #2299 - link viewModelScopeFactory scope to its parent scope
• 8b99903 Merge pull request #2443 from InsertKoinIO/docs/2417b-viewmodelscope-option
• 7bb09d3 Docs: viewModelScope { } requires viewModelScopeFactory() option (#2417)
• 931132e Merge pull request #2442 from InsertKoinIO/fix/2426-tvos-viewmodel-targets
• Additional commits viewable in compare view

Updates io.insert-koin:koin-core from 3.3.3 to 4.2.2

Release notes

Sourced from io.insert-koin:koin-core's releases.

Koin 4.2.2

Maintenance release for the 4.2.x line — resolver regression fixes from the 4.2.0 CoreResolverV2 rewrite, ViewModel/scope fixes, a Ktor request-scope fix, plus new tvOS support and an R8/ProGuard guide.

Anyone hitting resolver issues on 4.2.0/4.2.1 should upgrade to 4.2.2.

Bug Fixes

• Stacked params no longer shadow qualified dependencies (#2370, #2408) — A value passed via parametersOf could be returned for a get(named(...)) request of the same type, shadowing the qualified definition. Qualified lookups are now registry-only and never read the parameter stack — parameters carry no qualifier, so they can't satisfy a qualified request.

• Root factory no longer resolves its scoped dependencies from _root_ (#2379) — When a non-single factory defined in the root scope was resolved from a child scope, CoreResolverV2 resolved its scoped dependencies against _root_ instead of the requesting scope. Linked-scope resolution now runs the factory against the requesting scope (single instances keep their root-bound semantics, preserving #2325).

• viewModelScopeFactory scope is linked to its parent (#2299) — A ViewModel scope created via viewModelScopeFactory() was not linked to the originating scope, so dependencies declared in the parent couldn't be resolved. The created scope is now linked to its parent (except when the parent is root).

• Tolerate non-String environment properties (#2348) — Loading environment/system properties whose values aren't String threw ClassCastException due to an unchecked map cast. Non-String values are now preserved as Any and only String keys are required.

• Unique Ktor request-scope ids under concurrency (#2410) — Concurrent requests could collide on request-scope ids. Ids are now generated from a monotonic counter seeded once at startup. Thanks @​lfavreli-betclic!

• Actionable errors for SavedStateHandle / viewModelScope { } (#2044, #2417) — Resolving SavedStateHandle without the proper extras, or using viewModelScope { } without the viewModelScopeFactory() option, now produces a clear, actionable error message instead of an opaque failure.

Added

• tvOS targets for koin-core-viewmodel (#2426) — koin-core-viewmodel now publishes tvosArm64, tvosX64, and tvosSimulatorArm64, unblocking ViewModel usage on tvOS.

• Consumer R8/ProGuard rules + guide — Android and ViewModel artifacts now ship consumer R8/ProGuard rules in their AARs, and a new R8 / ProGuard guide documents keep rules for minified builds.

Improvements

• O(1) secondary-type registration in bind() / binds() — bind/binds now append secondary types in O(1) instead of reallocating the type list per binding, removing quadratic cost when a definition declares many bindings. No user-visible behavior change.

Documentation

• Navigation 3 typed entryProvider (#2336) — Added guidance on using Koin with the typed entryProvider in the Navigation 3 reference.

Contributors

Thanks to the following contributors for this release:

• @​arnaudgiuliani (Arnaud Giuliani)
• @​lfavreli-betclic (Loïc Favrelière) — unique Ktor request-scope ids under concurrency (#2432)

Koin 4.2.1

Support for Compile Safety with Koin Compiler 1.0.0-RC1

• Koin Compiler Plugin 1.0.0-RC1 - https://github.com/InsertKoinIO/koin-compiler-plugin/releases/tag/1.0.0-RC1

Bug Fixes

• Fix stacked-params lookup on linked scopes (#2387) — The 4.2.0 resolver rewrite (CoreResolverV2) walked linked scopes but dropped the per-parent stacked-parameters check that 4.1.x performed via recursion. This broke patterns where AndroidParametersHolder is stacked on the factory scope by KoinViewModelFactory and SavedStateHandle is then resolved from a child ViewModel scope. Linked-scope resolution now also checks stacked params on each parent scope.

• Restore ABI compatibility for runOnKoinStarted (#2391) — The 4.2.0 release inadvertently broke binary compatibility for runOnKoinStarted on JVM. Fixed by restoring the original JVM class name via @JvmName/@JvmMultifileClass annotations.

... (truncated)

Commits

• dc86ef8 Merge pull request #2448 from InsertKoinIO/release/4.2.2-finalize
• 376ba1c Finalize 4.2.2: version 4.2.2 + nav3 typed entryProvider docs (#2336)
• 0029f34 Merge pull request #2446 from InsertKoinIO/fix/2348-env-properties-cast
• 26020e8 Fix #2348 - tolerate non-String environment properties (ClassCastException)
• fff5291 Merge pull request #2432 from lfavreli-betclic/fix/2410-request-scope-atomic-id
• 961521c Merge pull request #2444 from InsertKoinIO/fix/2299-vmscope-link-parent
• 524eb25 Fix #2299 - link viewModelScopeFactory scope to its parent scope
• 8b99903 Merge pull request #2443 from InsertKoinIO/docs/2417b-viewmodelscope-option
• 7bb09d3 Docs: viewModelScope { } requires viewModelScopeFactory() option (#2417)
• 931132e Merge pull request #2442 from InsertKoinIO/fix/2426-tvos-viewmodel-targets
• Additional commits viewable in compare view

[DeepDiver1975]

Review — Koin 3.3.3 → 4.2.1 (major DI framework bump)

Reviewed as maintainer. This is a single-line version-catalog change, but it bumps the shared koin version ref that drives three artifacts (koin-core, koin-android, koin-androidx-workmanager) across a major version boundary (3.x → 4.x). Koin is the dependency-injection backbone here — org.koin.* is imported in 80+ source files — so a regression in the DI graph has app-wide blast radius (module definitions, KoinComponent injection, ViewModel/WorkManager scopes).

Blocking — CI is red. The Run Android Unit Tests check is failing on this PR (Detekt, instrumented data tests, validation all pass). A unit-test failure on a DI-framework major bump is exactly the signal that matters: it most likely reflects a compile/wiring break or a runtime DI-resolution change under Koin 4. This cannot be merged until that job is green and the failure root cause is understood (the expired logs should be re-run to capture it).

Koin 4 migration risks to verify before this can land (do not merge on a green-tests-alone basis without confirming these):

• API surface changes between 3.x and 4.x (e.g. KoinPlatformTools, scope/KoinScopeComponent APIs, koin-androidx-workmanager wiring) — confirm no source still depends on removed/renamed 3.x symbols.
• Min SDK / Kotlin / coroutines floors — Koin 4 raised its baselines; confirm this module's minSdk, Kotlin (1.9.20 here), and coroutines versions satisfy Koin 4.2.x requirements.
• CoreResolverV2 resolver rewrite (4.2.0): the 4.2.1 release notes explicitly call out that the new resolver regressed stacked-params lookup on linked scopes — specifically breaking AndroidParametersHolder stacked by KoinViewModelFactory + SavedStateHandle resolution from a child ViewModel scope (fixed in 4.2.1). Any ViewModel that injects SavedStateHandle via Koin must be smoke-tested at runtime, not just compiled.
• DI graph correctness at runtime — green unit tests alone don't prove the full module graph resolves; a checkModules/Koin verify test or a manual app-launch smoke test is warranted given the breadth of usage.

Verdict: changes-requested. Get Run Android Unit Tests green, identify the failure cause, and confirm the migration points above before re-review. Branch is also BEHIND main and needs a rebase. Holding off on approval/merge.

Automated maintainer review by Claude Code review agent.

[joragua]

@dependabot rebase