chore: upgrade to Kotlin 2.4.0 and Gradle 9.5.1, bump dependencies

[morisil]

Summary

• Kotlin 2.4.0 (kotlinTarget 2.4), Gradle wrapper 9.5.1
• kotlinx-coroutines 1.11.0, Ktor 3.5.0, slf4j 2.0.18, logback 1.5.34
• xemantic-kotlin-core 0.8.0, JReleaser 1.24.0
• Add nl.littlerobots.version-catalog-update plugin, configured to preserve the manual, logically-grouped ordering of libs.versions.toml
• Pin org.ow2.asm to 9.9.1 via a resolution strategy

🤖 Generated with Claude Code

[claude]

Code Review

Overview

This PR upgrades the core toolchain and dependencies:

• Kotlin 2.3.21 → 2.4.0 (kotlinTarget 2.3 → 2.4)
• Gradle wrapper 9.4.1 → 9.5.1
• kotlinx-coroutines 1.10.2 → 1.11.0
• Ktor 3.4.3 → 3.5.0
• slf4j 2.0.17 → 2.0.18, logback 1.5.32 → 1.5.34
• xemanticKotlinCore 0.6.4 → 0.8.0
• JReleaser 1.23.0 → 1.24.0
• Adds nl.littlerobots.version-catalog-update plugin
• Pins org.ow2.asm to 9.9.1 via resolution strategy

Overall the changes are clean and well-scoped. A few things worth addressing:

---

Issues

1. Stale / contradictory comment in libs.versions.toml

# don't upgrade these 2 until kotlin-2.3.10 is released with native linux compilaiton hang fix
kotlinxSerialization = "1.11.0"
ktor = "3.5.0"

This comment has two problems:

• Ktor was bumped to 3.5.0 in this very PR, yet the comment still says "don't upgrade these 2". The comment should either be removed (if the Kotlin 2.4.0 upgrade resolves the hang) or narrowed to only mention kotlinxSerialization.
• "kotlin-2.3.10" – we're now targeting Kotlin 2.4, so this milestone is moot. The referenced bug was a 2.3.x concern; if it's resolved in 2.4.0, remove the hold entirely; if serialization still lags, update the comment to reflect the new situation.
• Minor typo: compilaiton → compilation.

2. No explanation for the ASM pin

configurations.all {
    resolutionStrategy.eachDependency {
        if (requested.group == "org.ow2.asm") {
            useVersion(libs.versions.asm.get())
        }
    }
}

This is a valid pattern, but without a comment future maintainers won't know why ASM is being forced to 9.9.1. A one-liner would help — e.g. something like // Pin ASM: Kotlin 2.4.0 and Gradle 9.5.1 pull in conflicting ASM transitive versions. Same for the asm = "9.9.1" entry in libs.versions.toml — the CLAUDE.md keep.versions rationale is good, but the version itself has no "why pinned here" context.

---

Observations / Questions

3. xemanticKotlinCore 0.6.4 → 0.8.0 (minor version jump)

That's a two-minor-version bump from a related library. If there are API changes in 0.8.0 that required adaptation in this codebase, it's worth noting in the PR body. If it's a pure drop-in, disregard.

4. kotlinxSerialization stays at 1.11.0 after moving to Kotlin 2.4

Is there still a reason to hold serialization at 1.11.0 now that Kotlin 2.4.0 is the target? If the Linux native compilation hang was a Kotlin 2.3 bug and 2.4 resolves it, serialization could likely be bumped too. Worth a comment even if the hold remains.

5. Removal of license header from gradle-wrapper.properties

Removing the Apache 2.0 header from the wrapper properties file is sensible — it's a Gradle-generated file, not project source — but worth confirming this is intentional and not an accidental casualty of the wrapper regeneration.

---

What's Good

• sortByKey = false in versionCatalogUpdate correctly preserves the logical grouping in libs.versions.toml.
• Explicitly listing kotlinTarget, javaTarget, and asm in keep.versions ensures those non-version.ref entries survive catalog update runs.
• keepUnusedVersions = false is a reasonable hygiene setting given the explicit keep list.
• The gradlew script update (pinning the template commit SHA) is expected from wrapper regeneration.
• Formatting changes (removing blank lines inside [libraries]) are consistent with what the version-catalog-update plugin normalises, so they won't regress.

---

Summary

Good, routine upgrade PR. The main actionable item is cleaning up the stale "don't upgrade these 2" comment — it's now misleading since ktor was upgraded and we're past the 2.3.x concern. The ASM pin deserves a brief comment explaining why it exists. Everything else is clean.

[claude]

Correction to the earlier review (Issue #1):

Apologies — Issue #1 in the previous review comment was incorrect. The # don't upgrade these 2 until kotlin-2.3.10 is released... comment is actually removed by this PR (it appears as a - line in the diff), not kept. That concern does not apply.

The rest of the review stands:

• ASM pin: a brief comment explaining why ASM is being forced to 9.9.1 would help future maintainers.
• xemanticKotlinCore 0.6.4 → 0.8.0: if 0.8.0 had any breaking API changes requiring adaptation here, the PR body is a good place to note that; if it's drop-in, disregard.
• kotlinxSerialization stays at 1.11.0: worth confirming whether the hold is still intentional now that we're on Kotlin 2.4, or whether it can be bumped in a follow-up.
• License header removal from gradle-wrapper.properties: presumably intentional (Gradle regenerates this file without project headers), just confirming.

Overall this is a clean, well-structured upgrade PR. No blockers.