Details

Summary

pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication.

Impact

A malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count.
With a large enough value, the client spends an unbounded amount of CPU time inside PBKDF2 before authentication can fail.
A single attempt ties up a CPU core. Repeated or concurrent attempts exhaust client CPU and can wedge connection pools.

In affected versions, loginTimeout did not fully mitigate this problem. When loginTimeout expired, the caller could stop waiting, but the worker thread performing the connection attempt could continue running and burning CPU inside the SCRAM PBKDF2 computation.

This issue affects availability. It does not provide authentication bypass, privilege escalation, or direct password disclosure.

A user is vulnerable when all of the following are true:

1. The connection uses SCRAM-SHA-256 authentication.
2. The client reaches a malicious, compromised, or attacker-controlled PostgreSQL endpoint.
3. That endpoint sends a very large SCRAM PBKDF2 iteration count in the server-first-message.

In practice, that can happen in these situations:

• the application lets end users or tenants supply their own database connection details (as in many BI, reporting, analytics, ETL, and low-code platforms), so a user can point the shared client host at a server they control
• the application accepts connection strings, hostnames, or JDBC URLs from user input, configuration uploaded by users, or other untrusted sources
• the application is configured to connect to a PostgreSQL server that is itself malicious or later becomes compromised
• the application connects through an untrusted proxy, relay, tunnel, bastion, or connection-pooling service that can act as the PostgreSQL server
• an attacker can redirect the client to a fake PostgreSQL endpoint by manipulating DNS, service discovery, Kubernetes service resolution, /etc/hosts, environment variables, or similar indirection
• an active network attacker on the path can impersonate the server because the connection does not strongly verify server identity (for example, sslmode lower than verify-full, or trusting a CA that signs hosts outside the operator's control)

The issue is more damaging when the application uses connection retries, many parallel connection attempts, or loginTimeout and assumes the timeout fully stops the work.

Patches

The patch introduces a new connection property, scramMaxIterations, with a default of 100K. The client now rejects SCRAM server messages that advertise more PBKDF2 iterations than the configured cap before starting the PBKDF2 computation begins.

Workarounds

Until a patched version of pgjdbc is deployed, the following measures reduce exposure:

1. Only connect to trusted PostgreSQL servers whose identity is verified.
   Connect only to trusted PostgreSQL servers, and verify server identity with TLS using sslmode=verify-full and a trusted CA.
   TLS without certificate and hostname verification is not sufficient as an active network attacker can still impersonate the server.

2. Do not rely on loginTimeout as a complete mitigation on unpatched versions.
   On affected versions, loginTimeout can stop the waiting caller while the worker thread continues spending CPU.

3. Avoid SCRAM on untrusted or interceptable connection paths.
   For those paths, use an authentication method that does not let the server choose a SCRAM PBKDF2 iteration count.

4. Reduce blast radius operationally.
   Limit parallel connection attempts, add retry backoff, isolate connection establishment in a separate worker or process when possible, and apply CPU or container limits where appropriate.

5. On trusted servers you control, keep SCRAM iteration counts at ordinary values.
   This does not defend against an attacker-controlled server, but it avoids unnecessary client cost when talking to legitimate servers.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-98qh-xjc8-98pq
• https://nvd.nist.gov/vuln/detail/CVE-2026-42198
• https://github.com/pgjdbc/pgjdbc/releases/tag/REL42.7.11
• https://github.com/advisories/GHSA-98qh-xjc8-98pq

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

v7.0.0

Compare Source

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in #​2454
• Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @​dependabot[bot] in #​2458
• Bump flatted from 3.3.1 to 3.4.2 by @​dependabot[bot] in #​2460
• Bump js-yaml from 4.1.0 to 4.2.0 by @​dependabot[bot] in #​2461
• Bump @​actions/core and @​actions/tool-cache and Remove uuid by @​dependabot[bot] in #​2459
• upgrade module to esm and update dependencies by @​aiqiaoy in #​2463
• Bump the minor-npm-dependencies group across 1 directory with 3 updates by @​dependabot[bot] in #​2462

v7

Compare Source

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in #​2454
• Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @​dependabot[bot] in #​2458
• Bump flatted from 3.3.1 to 3.4.2 by @​dependabot[bot] in #​2460
• Bump js-yaml from 4.1.0 to 4.2.0 by @​dependabot[bot] in #​2461
• Bump @​actions/core and @​actions/tool-cache and Remove uuid by @​dependabot[bot] in #​2459
• upgrade module to esm and update dependencies by @​aiqiaoy in #​2463
• Bump the minor-npm-dependencies group across 1 directory with 3 updates by @​dependabot[bot] in #​2462

v6.0.3

Compare Source

• Fix checkout init for SHA-256 repositories by @​yaananth in #​2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in #​2414

v6.0.2

Compare Source

• Fix tag handling: preserve annotations and explicit fetch-tags by @​ericsciple in #​2356

v6.0.1

Compare Source

• Add worktree support for persist-credentials includeIf by @​ericsciple in #​2327

v42.7.11

Security

• fix: Limit SCRAM PBKDF2 iterations accepted from the server.
  pgjdbc was vulnerable to a client-side denial of service in SCRAM-SHA-256 authentication, where a malicious or compromised PostgreSQL server could specify an extremely large PBKDF2 iteration count, causing the client to consume unbounded CPU and potentially exhaust connection pools. The fix introduces a new scramMaxIterations connection property (defaulting to 100,000) to cap iteration counts before computation begins.
  See the Security Advisory for more detail.
  The following CVE-2026-42198 has been issued.

Added

• feat: implement require_auth connection property, aligning with libpq behavior PR #​3895

Changed

• chore: replace Appveyor CI with ikalnytskyi/action-setup-postgres PR #​3966
• chore: upgrade Gradle to v9 PR #​3978

Fixed

• fix: ensure extended protocol messages end with Sync message PR #​3728
• fix: enable cursor-based fetching in extended protocol when transaction started via SQL command PR #​3996
• fix: retry with SSL on IOException when sslMode=ALLOW PR #​3973
• fix: make sure the driver honours connectTimeout when retrying the connection PR #​3968
• fix: allow fallback to non-SSL connection when sslMode=prefer and sslResponseTimeout kicks in PR #​3968
• fix: catch SecurityException from setContextClassLoader on ForkJoinPool workers PR #​3962
• fix: use compareTo for LogSequenceNumber comparison to handle unsigned values correctly PR #​3961
• fix: release COPY lock on IOException to prevent connection hang PR #​3957
• fix: return jsonb as PGObject instead of String PR #​3956
• fix: align SSL key file permission check with libpq PR #​3952
• fix: guard connection closed flag with a reentrant lock to protect against concurrent close PR #​3905

v5.23.0

NOTE: Breaking change for Android

The mockito-android artifact has a breaking change: tests now require a device or emulator based on API 28+ (Android P). This is to enable new support for mocking Kotlin classes. See #​3788 for more details.

^{Changelog generated by Shipkit Changelog Gradle Plugin}

5.23.0

• 2026-03-11 - 6 commit(s) by Brice Dutheil, Joshua Selbo, Philippe Kernevez
• Replace mockito-android mock maker implementation with dexmaker-mockito-inline (#​3792)
• Fix StackOverflowError with AbstractList after using mockSingleton (#​3790)
• Mark parameters of Mockito.when @Nullable (#​3503)

v3.0.3: springdoc-openapi v3.0.3 released!

Added

• #​3246 – Add Springdoc OpenAPI MCP (Model Context Protocol) support
• #​3256 – Auto-set nullable: true for Kotlin nullable types in schema properties
• #​3239 – Add support for the @Range constraint validation annotation
• #​3244 – Handle default values for LocalDate

Changed

• Upgrade Spring Boot to version 4.0.5
• Upgrade swagger-core to version 2.2.47
• Upgrade swagger-ui to version 5.32.2
• #​3260 – @ConditionalOnClass(HateoasProperties.class) in SpringDocHateoasConfiguration
• Forwards all MCP non-transport headers to downstream methods
• Dynamically resolve the base path from window.location.pathname for MCP UI

Fixed

• #​3258 – Setting API Version Required when using WebFlux breaks the Swagger UI
• #​3259 – Annotated Generic properties getting applied to sibling properties
• #​3255 – Direction enum: fixed visibility scope of group order so that setGroupsOrder method can be used
• #​3247 – Preserve YAML group URLs in Swagger UI
• #​3245 – Upgrade swagger-core from version 2.2.43 to 2.2.45
• #​3235 – PropertyResolverUtils retains a JsonNode when reading an ExtensionProperty annotation
• #​3226 – Propagate JsonView context when resolving Page<T> schema

New Contributors

• @​seregamorph made their first contribution in #​3260

Full Changelog: springdoc/springdoc-openapi@v3.0.2...v3.0.3

v11.38.1

Compare Source

v11.38

Compare Source

v11.37.2

Compare Source

v11.37.1

Compare Source

v11.37

Compare Source

v11.36

Compare Source

v11.35

Compare Source

v3.7.1

Compare Source

Changes:

• #​718: Fix deploy timeout

v3.7.0

Compare Source

Enhancement:

• #​717: Update ktlint to 1.8.0 and kotlin to 2.2.21

v3.6.0

Compare Source

Enhancement:

• #​681: Update to ktlint 1.7.1 and kotlin 2.2.0
  • Thanks to @​JonathanLennox for the PR

Other changes:

• #​662: Upgraded commons-codec:commons-codec from 1.17.2 to 1.18.0
• #​671: Updated GitHub Actions runner
• #​663: Upgraded commons-logging:commons-logging from 1.3.4 to 1.3.5
• #​664: Upgraded commons-beanutils:commons-beanutils from 1.10.0 to 1.10.1
• #​685: Fix devcontainer
• #​686: Fix devcontainer
• #​687: Migrate deployment to Sonatype Central Portal
• #​688: Fix Maven deploy
• #​688: Fix formatting (fix-deploy)
• #​666: Bump org.codehaus.plexus:plexus-classworlds from 2.8.0 to 2.9.0
• #​669: Bump org.codehaus.plexus:plexus-interpolation from 1.27 to 1.28
• #​673: Bump commons-beanutils:commons-beanutils from 1.10.1 to 1.11.0
• #​675: Bump org.apache.commons:commons-lang3 from 3.17.0 to 3.18.0
• #​676: Bump commons-io:commons-io from 2.18.0 to 2.20.0
• #​679: Bump actions/setup-java from 4 to 5
• #​680: Bump codecov/codecov-action from 5.3.1 to 5.5.1
• #​682: Bump org.apache.commons:commons-lang3 from 3.17.0 to 3.19.0
• #​683: Bump actions/checkout from 4 to 6
• #​689: Bump org.codehaus.plexus:plexus-utils from 4.0.2 to 4.0.3
• #​690: Update Dependabot to allow newer Maven versions
• #​693: Bump org.apache.maven:maven-core from 3.5.4 to 3.8.1
• #​691: Bump codecov/codecov-action from 5.5.1 to 6.0.0
• #​694: Bump org.jetbrains.dokka:dokka-maven-plugin from 2.0.0 to 2.2.0
• #​695: Bump org.codehaus.mojo:animal-sniffer-maven-plugin from 1.24 to 1.27
• #​696: Bump commons-codec:commons-codec from 1.18.0 to 1.21.0
• #​692: Bump maven.version from 3.8.1 to 3.8.9
• #​698: Add org.dom4j:dom4j dependency to dependabot configuration
• #​703: Bump org.dom4j:dom4j from 2.1.4 to 2.1.5
• #​704: Add org.codehaus.plexus:plexus-xml dependency to dependabot configuration
• #​699: Bump org.codehaus.plexus:plexus-interpolation from 1.28 to 1.29
• #​700: Bump commons-logging:commons-logging from 1.3.5 to 1.3.6
• #​701: Bump org.apache.maven.plugin-tools:maven-plugin-annotations
• #​706: Bump commons-io:commons-io from 2.20.0 to 2.21.0
• #​707: Add maven-reporting-impl dependency to dependabot configuration
• #​708: Add plexus-classworlds dependency to dependabot config
• #​710: Add maven-plugin-testing-harness to dependabot config
• #​711: Add Guice to dependabot config
• #​712: Bump com.google.inject:guice from 4.2.2 to 4.2.3
• #​713: Add doxia-sink-api-ktx to dependabot config
• #​714: Bump doxia-sink-api-ktx version to 1.6.1
• #​715: Update build Maven version to 3.9.14
• #​716: Update Maven Central badge to use img.shields.io

v7.24.0: released

Compare Source

v7.24.0 stable release (breaking changes with fallbacks) comes with 170+ enhancements and bug fixes.

Below are the highlights of the changes. For a full list of changes, please refer to the "Pull Request" tab.

General

• fix(docker): update base image to eclipse-temurin 17.0.19 on Ubuntu 24.04 (noble) #​24230
• fix(InlineModelResolver): do not merge untitled inline schemas differing only by description #​24192
• Fix vulnerable dependency CVE-2026-54512 #​24166
• [core] Add introspection support for discovering the discriminator type in a oneOf allOf polymorphic structure #​24158
• refactor: introduce DiscriminatorUtils to separate handling of discriminator discoverability #​24143
• fix: normalize OAS 3.1 schemas with type:[object,"null"] to set nullable:true correctly #​24140
• feat(spec-merge): add alternative DEEP merge mode with by-method path merging and configurable conflict resolution strategy #​24100
• [core] Restore sibling example for allOf with a single $ref (#​23335) #​24081
• [core] Fix UnsupportedOperationException for oneOf members declaring x-implements (#​23577) #​24076
• [CORE] - Feature: forcedGenerateSchemas — Force generation of schema-mapped or import-mapped schemas #​24066
• [Core] bug - fix OAS 3.1 nullable validation when using older "nullable: true" syntax instead of type: [null, ...] #​24026
• fix(online): thread-safe fileMap with TTL cleanup, SLF4J logging, and Content-Length header #​24011
• [BUG][core] Normalize OAS 3.1 type: null map value (additionalProperties) under NORMALIZE_31SPEC #​23967
• Add validate Mojo to Maven Plugin #​23911
• feat: add quiet mode to suppress verbose generation output #​23831

asciidoc

• fix(asciidoc): escape table cell pipes in generated docs #​24184

avro

• fix(avro): order "null" first in union when default is null #​24135

C++

• fix(cpp-httplib-server): serialize enums using spec values #​24187

C#

• fix(aspnetcore): remove obsolete wwwroot README #​24283
• [csharp][generichost] Refactor duplicate apis #​24273
• [csharp][generichost] Revert to DropWrite #​24080
• [csharp][generichost] Add OnCreated to JsonConverter #​24079

Crystal

• [Crystal] Add request-signing seam (Configuration#sign_request) #​24221
• [Crystal] idiomatic api redesign #​24070

Dart

• Dart2 class and enum improvements #​24286
• [dart-dio][built_value] Register BuilderFactory for nested additionalProperties shapes #​24154
• [dart-dio][built_value] Honor optional non-nullable properties in deserialize_properties.mustache #​23661
• [dart-dio] Fix webhook imports generating Map-style strings #​22611

Go

• fix(golang): make object values nullable when specified #​24265
• fix(go-server): allow zero values for required request body fields #​24262
• fix(go-server): skip readOnly fields in AssertXxxRequired #​24257
• fix(go-server): use operationId consistently to fix uncompilable output for duplicate operationIds #​24169
• [Go] Honor generateUnmarshalJSON=false for oneOf models #​24062

Java

• [Java][apache-httpclient] Apply connect timeout to requests, add read timeout support #​24284
• [java][microprofile] Extend useSealedOneOfInterfaces support to the microprofile library #​24267
• [java][microprofile] Extend support for useOneOfInterfaces to the microprofile library when Jackson serialisation is enabled #​24190
• [java][jaxrs-spec] - Add support for sealed classes and interfaces with useSealed flag #​24189
• [KOTLIN-SPRING;JAVA-SPRING] bugfix: update JsonInclude annotations for optional+nullable fields to handle serialization correctly when openApiNullable = true #​24185
• [java][jaxrs-spec][quarkus] - Add support for OneOfInterfaces & fix JsonTypeName value resolution #​24174
• Convert maintained JAX-RS samples to JUnit 5 #​24173
• fix: normalize Java annotation vendor extension lists #​24171
• [jaxrs-spec] Add @​JsonIgnoreProperties on the discriminator to avoid duplicated keys during serialisation #​24132
• [java] honor useJspecify in restclient/webclient ApiClient support class #​24055
• [Java][vertx] Apply Vert.x pool defaults in buildWebClient for useVertx5 #​24017
• [Java] Render object default for composed ($ref + default) schemas (#​23795) #​23971

Julia

• [julia-server] Use req.headers for HTTP.jl 2.x compatibility #​24102

Kotlin

• [KOTLIN-SPRING;JAVA-SPRING] bugfix: update JsonInclude annotations for optional+nullable fields to handle serialization correctly when openApiNullable = true #​24185
• [Kotlin][Spring] fix option useSpringBuiltInValidation not implemented #​24115
• [KOTLIN-SPRING/KOTLIN-CLIENT] BUG - fix json deserialization when kotlin attribute name differs from json attribute name #​24036
• [kotlin] Fix boolean const enum literal generation #​24022
• [kotlin-spring, java-spring] - gate @​JsonSetter on openApiNullable for optional non-nullable fields #​23993

openapi, openapi-yaml

• [openapi, openapi-yaml] feature - add sortOutput option to deterministically sort paths and schemas, http methods, etc... #​24037

PHP

• [PHP] Skip length validation for DateTime model properties #​24254
• Update php-laravel to newer versions #​24196
• [php-nextgen] Fix undefined variable $queryParams #​24136
• [php-nextgen] Code improvements #​23986
• [php-nextgen] oneof polymorphism #​23985
• [php-nextgen] Fix for enum allowed values #​23814

Python

• [python] support legacy model dictionaries #​24290
• fix(python-fastapi): map binary response type file to bytes #​24285
• [python] bump generated client dependency floors above vulnerable ranges #​24186
• feat(python-flask): add opt-in Connexion 3 support #​24181
• [python] Set API key cookie as key-value pair #​24149
• [python] centralize the Python constraint rules #​24141
• [python] preserve public model field names #​24131
• [python] isolate implicit API clients #​24129
• [python] add supportHttpxSync option for sync httpx methods #​24128
• [python] separate property and parameter mappings #​24121
• [python] escape model wire names #​24120
• [python] serialize structured YAML bodies #​24084
• [python] honor proxy environment settings #​24082
• [python] Run regex pattern validators in mode="before" so they see the wire value #​24072
• fix(python): remove redundant debug setter call in deepcopy #​23958
• [python][client] Add Decimal support to mapNumberTo functionality #​23916
• fix(python-flask): validate byte length for format:byte fields #​23177

Ruby

• [Ruby] Add new ruby-nextgen client generator (opt-in idiomatic redesign) #​24220
• fix(ruby): JSON-encode query params with content:application/json #​24126

Rust

• fix(rust-server): Handle multiple content-types in responses #​24179
• [rust-server] Fix panic on binary request bodies coerced to UTF-8 #​24116
• [Rust-Axum] Fix generating error upon special model name #​23994
• [Rust-Axum] Support Server-Sent Events (SSE) #​23977

Scala

• [scala-sttp4-jsoniter] support set parameters (uniqueItems arrays) in query, header, path and cookie parameters #​24301

TypeScript

• fix(typescript-fetch): allow null for required nullable parameters #​24292
• [typescript-fetch] Fix Omit generic using baseName for readOnly fields #​24275
• typescript-fetch: default to es6 support #​24226
• fix(typescript-fetch): skip scalar enum comparison for array-typed properties in instanceOf #​24217
• fix(typescript-fetch): add anyToJSON to runtime.ts #​24216
• fix(typescript-fetch): optional nullable fields return null instead of undefined #​24215
• [typescript] Align multipart file array handling #​24133
• fix(typescript-nestjs-server): import generic return types #​24005
• [typescript-fetch] Fix TS2590 in instanceOf guards for wide sanitized-name models #​23982

v7.23.0: released

Compare Source

v7.23.0 stable release (breaking changes with fallbacks) comes with 170+ enhancements and bug fixes.

This release comes with 2 breaking changes (with fallback):

• [jaxrs-spec][quarkus] Emit @​RolesAllowed({"**"}) for HTTP Basic, Bearer, api-key and OAuth2 or OpenID with empty scopes and rename "useQuarkusSecurityAnnotations" to "useJakartaSecurityAnnotations" (Breaking change (with fallback)) #​23680
• fix(Kotlin): use the global apiNamePrefix and apiNameSuffix settings instead of apiSuffix (generator's option) (Breaking change (with fallback)) #​23926

Below are the highlights of the changes. For a full list of changes, please refer to the "Pull Request" tab.

General

• Normalizer: new rule LOOSE_NULL_DEFINITIONS to allow more null definitions in 3.0 spec. #​23932
• fix(InlineModelResolver): prevent numbered duplicate models from multi-file OAS 3.1 specs #​23856
• fix(core): normalize OAS 3.1 content media schemas #​23851
• [GRADLE-WRAPPER] feat: add configurable worker isolation and max heap size for code generation #​23648 by
• [GRADLE-WRAPPER] bug fix - pass maven java_home to gradle correctly #​23646
• Add security schemes filter normalizer option #​23174

C#

• [csharp][generichost] Deserialize present-but-null nullable enums #​23912
• [csharp] Fix HTTP signature auth failure on .NET 8 when query params contain special characters #​23714
• [csharp][restsharp] add throwOnAnyError option to surface client errors #​23663
• Fix/csharp reserved headers and file parameter not serialising correctly #​23593
• [csharp] Extend HostConfiguration with additional AddApiHttpClients signatures #​22500

Dart

• feat(dart): make requests abortable #​23930
• [Dart] Preserve uppercase names with trailing digits #​23894
• [BUG][DART] fix nullable nested array item handling #​23365

Go

• fix(go): avoid duplicate unknown enum defaults #​23909
• [go] support io.Reader and []byte response types in client decode #​23789

Java

• [Java][restclient] Build XmlMapper via builder when useJackson3=true #​23872
• [Java] [vertx] Allow PoolOptions configuration when vertx 5 #​23829
• feat(java/jersey3): add jackson 3 support #​23819
• feat(java/jersey3): Update jakarta annotation and validation libs #​23810
• [JAVA-SPRING] spring http interface library should support 'useBeanValidation' #​23803
• [jaxrs-spec][quarkus] Emit @​PermitAll for unauthenticated operations (op/global empty security, anonymous OR alternative, no security defined) #​23782
• [JavaJaxRS] [CXF] Add Support for Jackson3 #​23767
• [jaxrs-spec][quarkus] Emit @​RolesAllowed({scope}) for OAuth2 and OpenID Connect operations with explicit scopes #​23752
• [jaxrs-spec][quarkus] - Add CLI flag (useQuarkusSecurityAnnotations) to enable emitting security annotation (@​Authenticated, @​RolesAllowed, @​PermitAll) #​23699
• [JAVA-SPRING;KOTLIN-SPRING] feature - add support for 'substituteGenericPagedModel' also for 'spring-cloud' libraries #​23690
• [jaxrs-spec][quarkus] Emit @​RolesAllowed({"**"}) for HTTP Basic, Bearer, api-key and OAuth2 or OpenID with empty scopes and rename "useQuarkusSecurityAnnotations" to "useJakartaSecurityAnnotations" (Breaking change (with fallback)) #​23680
• [jaxrs-spec][quarkus]: Emit @​ResponseStatus annotation for 2XX success codes #​23673
• [Java] [vertx] Make supportVertxFuture compatible with vertx 5 #​23660
• Fix Jspecify nullable issue with spring boot 4 #​23649
• [java][spring] fix: disableDiscriminatorJsonIgnoreProperties not working #​23640
• [java] Support 'time-local' format #​23555
• [java] Support 'date-time-local' format #​23395
• [Spring] Add clientRegistrationId option for OAuth2 HTTP Interface #​22726

Kotlin

• fix(Kotlin): use the global apiNamePrefix and apiNameSuffix settings instead of apiSuffix (generator's option) (Breaking change (with fallback)) #​23926
• [kotlin-client][jvm-ktor] Support nullable response types #​23870
• feat(kotlin-client): support dynamic auth credentials for okhttp client (#​23835) #​23836
• [KOTLIN-SPRING] - add support for 'openApiNullable' - jackson nul

✂ Note

PR body was truncated to here.