chore(deps): bump io.insert-koin:koin-compiler-gradle-plugin from 1.0.2 to 1.1.0 in the koin group

[dependabot]

Bumps the koin group with 1 update: io.insert-koin:koin-compiler-gradle-plugin.

Updates io.insert-koin:koin-compiler-gradle-plugin from 1.0.2 to 1.1.0

Release notes

Sourced from io.insert-koin:koin-compiler-gradle-plugin's releases.

1.1.0

A compile-safety architecture release: per-module validation is removed entirely in favor of a single, authoritative full-graph check at each Koin entry point. This closes a real, measured false-positive class, at the cost of leaf modules with no entry point of their own now getting no compile-time safety diagnostics until something assembles a real graph around them. Also ships incremental-compilation freshness hardening, allWarningsAsErrors compatibility, and a collision-safe hint-file-naming scheme.

⚠️ Behavior change — per-module validation removed, full-graph validation only (#32, #51)

Why. A module validated in isolation cannot know how it will be wired into a larger app. This stopped being theoretical: :core:notifications in a real playground app genuinely false-positived on a dependency (PeerService) that a peer module provides — with no Gradle edge between the two, the two are only unified downstream at the app's entry point. Per-module validation — checking a module against its own definitions, its includes = [...], and its @Configuration siblings — cannot see that far, and reported a hard KOIN-D001 for a dependency that resolves correctly once the real app assembles both modules together. Rather than keep tuning the per-module oracle around each new false-positive shape, per-module validation (and its "defer iff a provider exists somewhere" oracle) is deleted outright. Full-graph validation — the check that runs at startKoin/koinApplication/@KoinApplication — is now the sole compile-safety verifier.

What this means for you:

• Rooted compiles (an app module with a real startKoin/koinApplication/@KoinApplication): more accurate. Genuine cross-module false positives like the peer-provider case above disappear; KOIN-D001 now always shows the real, assembled graph.
• Leaf/library modules with no Koin entry point in their own compilation: KOIN-D001 (missing dependency), KOIN-D004 (circular dependency), KOIN-D005/KOIN-D006 (parametersOf shape mismatches resolved via the graph), and KOIN-P001 (missing @PropertyValue) are now silent in that compilation — not because the module is safe, but because compile-time cannot know how it will be assembled downstream. The graph is still checked, correctly, at the real entry point once one exists in the compilation. This is disclosed via a default-visible (INFO-severity) message rather than failing silently; see logSeverity below to control its visibility.
• KOIN-W002 (the old "deferred, no provider hint found anywhere" warning) is deleted — there is no more deferral machinery to warn about.
• Circular-dependency detection (KOIN-D004) going silent for a leaf module is intentional, not a regression: detecting a cycle requires seeing the whole graph, and a same-module-only check was never a complete cycle detector even under the old per-module validation (it only ever saw local/sibling visibility).

Full account, including the design docs this reverses: docs/COMPILE_SAFETY_A3_PLAN.md (superseded-banner) and docs/COMPILE_TIME_SAFETY.md.

🐛 Fixes

Orphaned @Module classes were silently treated as reachable (found during this release's own verification)

A plain @Module @ComponentScan(...) class with no @Configuration and not referenced by anyone's includes = [...] was silently treated as part of the graph anyway, as long as the entry point used a bare/default-labeled @KoinApplication/startKoin — the overwhelmingly common case. Its @ComponentScan-discovered definitions (including cross-module ones) were folded into the resolved

... (truncated)

Changelog

Sourced from io.insert-koin:koin-compiler-gradle-plugin's changelog.

1.1.0 (traced to 1.0.0-GA1) but was masked by the old per-module validation, which used to validate each such module in isolation too; removing it made this bug load-bearing. Fixed, with a regression test (entry_orphan_module_not_reachable_d001) proving an orphaned module without @Configuration or an includes edge is now correctly excluded from the graph.

KOIN-D001 now names the real culprit module and source location

Missing-dependency errors now carry file:line for the failing definition and the actual owning module's name (previously degraded to a generic app/root label once every KOIN-D001 funnels through the one remaining full-graph check). Also fixed: attribution for FunctionDef-shaped definitions used a bare simple name, which could collide across same-named modules in different packages — now uses the fully-qualified name.

KOIN-D001 deduplication across multiple entry points

A module reachable from more than one startKoin/koinApplication/@KoinApplication in the same compilation (common in test-apps: ~9 entry points is typical) previously re-validated and re-emitted the same missing-dependency error once per entry point. Now deduplicated by (definition, missing requirement), so a shared module with one real problem reports it exactly once.

D005/D006 (parametersOf shape checks) no longer require a Koin entry point

The parametersOf(...) argument-count/presence check is graph-independent — the expected slots come from the target's own constructor, not from an assembled graph — so it now runs unconditionally instead of being skipped whenever no entry point is present in the compilation, matching its actual data dependency. KOIN-D002 (call-site resolution) correctly keeps requiring an assembled graph and stays silent without one — the two diagnostics no longer share a gate they don't share a dependency on.

Cross-module qualifier and typed-scope resolution verified under the new sole-verifier design

New regression coverage confirms full-graph validation matches @Named qualifiers and typed @Scope(X::class) keys correctly across Gradle module boundaries, not just "some provider of this type exists somewhere" — this matters more now that there's no per-module fallback to catch a wrong match.

Known pre-existing limitation, found while writing this coverage (not new, not fixed this release): BindingRegistry.findProvider's scope-visibility check only matches a typed @Scope(X::class); a named @Scope(name = "...") provider has no scopeClass and is treated as visible everywhere regardless of name.

🔒 Incremental-compilation freshness

Removing per-module leaf-local checking made full-graph validation's own freshness across incremental (IC) rebuilds load-bearing in a way it wasn't before — these changes close that gap:

• strictSafety is now mandatory once an aggregator is auto-detected, not opt-in. Previously, an explicit strictSafety = false silently won over the plugin's own startKoin/ koinApplication/@KoinApplication detection, letting an aggregator's compileKotlin stay cacheable/up-to-date even when the DI graph changed underneath it (lambda-body DSL edits and new @ComponentScan-covered files don't register as ABI changes IC can see). strictSafety = true still works everywhere; the new escape hatch for a genuine detector misfire (the marker appears only in a comment/string, not a real entry point) is strictSafetyForceOff = true — a separate,

... (truncated)

Commits

• 5b3ccb3 Merge pull request #79 from InsertKoinIO/a3-completion
• 18288be fix(a3): KOIN-D001's fallback module label hardcoded "(startKoin)" for every ...
• f2cbe3e docs: fix stale A2 wording in PR Guard #3 procedure, tighten hint-collision r...
• 7f4353e docs: release-note the orphan-module fix, flag a stale PR Guard #3 edit for a...
• f4222e5 fix(a3): orphaned @​Module classes were silently treated as reachable from any...
• 944ec99 chore: release 1.1.0
• 3589760 docs: reconcile compile-safety docs with the A2 removal
• 4e05430 test(a3): regression coverage for the A2 removal — peer providers, qualifier/...
• 2980801 fix(a3): remove A2 entirely — A3 full-graph validation is now the sole compil...
• f91c396 feat: allWarningsAsErrors compatibility + mandatory strictSafety on detected ...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions