Bump io.insert-koin.compiler.plugin from 1.0.1 to 1.1.0

[dependabot]

Bumps io.insert-koin.compiler.plugin from 1.0.1 to 1.1.0.

Release notes

Sourced from io.insert-koin.compiler.plugin's releases.

1.1.0

A compile-safety architecture release: per-module validation is removed entirely in favor of a single, authoritative full-graph check at each Koin entry point. This closes a real, measured false-positive class, at the cost of leaf modules with no entry point of their own now getting no compile-time safety diagnostics until something assembles a real graph around them. Also ships incremental-compilation freshness hardening, allWarningsAsErrors compatibility, and a collision-safe hint-file-naming scheme.

⚠️ Behavior change — per-module validation removed, full-graph validation only (#32, #51)

Why. A module validated in isolation cannot know how it will be wired into a larger app. This stopped being theoretical: :core:notifications in a real playground app genuinely false-positived on a dependency (PeerService) that a peer module provides — with no Gradle edge between the two, the two are only unified downstream at the app's entry point. Per-module validation — checking a module against its own definitions, its includes = [...], and its @Configuration siblings — cannot see that far, and reported a hard KOIN-D001 for a dependency that resolves correctly once the real app assembles both modules together. Rather than keep tuning the per-module oracle around each new false-positive shape, per-module validation (and its "defer iff a provider exists somewhere" oracle) is deleted outright. Full-graph validation — the check that runs at startKoin/koinApplication/@KoinApplication — is now the sole compile-safety verifier.

What this means for you:

• Rooted compiles (an app module with a real startKoin/koinApplication/@KoinApplication): more accurate. Genuine cross-module false positives like the peer-provider case above disappear; KOIN-D001 now always shows the real, assembled graph.
• Leaf/library modules with no Koin entry point in their own compilation: KOIN-D001 (missing dependency), KOIN-D004 (circular dependency), KOIN-D005/KOIN-D006 (parametersOf shape mismatches resolved via the graph), and KOIN-P001 (missing @PropertyValue) are now silent in that compilation — not because the module is safe, but because compile-time cannot know how it will be assembled downstream. The graph is still checked, correctly, at the real entry point once one exists in the compilation. This is disclosed via a default-visible (INFO-severity) message rather than failing silently; see logSeverity below to control its visibility.
• KOIN-W002 (the old "deferred, no provider hint found anywhere" warning) is deleted — there is no more deferral machinery to warn about.
• Circular-dependency detection (KOIN-D004) going silent for a leaf module is intentional, not a regression: detecting a cycle requires seeing the whole graph, and a same-module-only check was never a complete cycle detector even under the old per-module validation (it only ever saw local/sibling visibility).

Full account, including the design docs this reverses: docs/COMPILE_SAFETY_A3_PLAN.md (superseded-banner) and docs/COMPILE_TIME_SAFETY.md.

🐛 Fixes

Orphaned @Module classes were silently treated as reachable (found during this release's own verification)

A plain @Module @ComponentScan(...) class with no @Configuration and not referenced by anyone's includes = [...] was silently treated as part of the graph anyway, as long as the entry point used a bare/default-labeled @KoinApplication/startKoin — the overwhelmingly common case. Its @ComponentScan-discovered definitions (including cross-module ones) were folded into the resolved

... (truncated)

Changelog

Sourced from io.insert-koin.compiler.plugin's changelog.

1.1.0 (traced to 1.0.0-GA1) but was masked by the old per-module validation, which used to validate each such module in isolation too; removing it made this bug load-bearing. Fixed, with a regression test (entry_orphan_module_not_reachable_d001) proving an orphaned module without @Configuration or an includes edge is now correctly excluded from the graph.

KOIN-D001 now names the real culprit module and source location

Missing-dependency errors now carry file:line for the failing definition and the actual owning module's name (previously degraded to a generic app/root label once every KOIN-D001 funnels through the one remaining full-graph check). Also fixed: attribution for FunctionDef-shaped definitions used a bare simple name, which could collide across same-named modules in different packages — now uses the fully-qualified name.

KOIN-D001 deduplication across multiple entry points

A module reachable from more than one startKoin/koinApplication/@KoinApplication in the same compilation (common in test-apps: ~9 entry points is typical) previously re-validated and re-emitted the same missing-dependency error once per entry point. Now deduplicated by (definition, missing requirement), so a shared module with one real problem reports it exactly once.

D005/D006 (parametersOf shape checks) no longer require a Koin entry point

The parametersOf(...) argument-count/presence check is graph-independent — the expected slots come from the target's own constructor, not from an assembled graph — so it now runs unconditionally instead of being skipped whenever no entry point is present in the compilation, matching its actual data dependency. KOIN-D002 (call-site resolution) correctly keeps requiring an assembled graph and stays silent without one — the two diagnostics no longer share a gate they don't share a dependency on.

Cross-module qualifier and typed-scope resolution verified under the new sole-verifier design

New regression coverage confirms full-graph validation matches @Named qualifiers and typed @Scope(X::class) keys correctly across Gradle module boundaries, not just "some provider of this type exists somewhere" — this matters more now that there's no per-module fallback to catch a wrong match.

Known pre-existing limitation, found while writing this coverage (not new, not fixed this release): BindingRegistry.findProvider's scope-visibility check only matches a typed @Scope(X::class); a named @Scope(name = "...") provider has no scopeClass and is treated as visible everywhere regardless of name.

🔒 Incremental-compilation freshness

Removing per-module leaf-local checking made full-graph validation's own freshness across incremental (IC) rebuilds load-bearing in a way it wasn't before — these changes close that gap:

• strictSafety is now mandatory once an aggregator is auto-detected, not opt-in. Previously, an explicit strictSafety = false silently won over the plugin's own startKoin/ koinApplication/@KoinApplication detection, letting an aggregator's compileKotlin stay cacheable/up-to-date even when the DI graph changed underneath it (lambda-body DSL edits and new @ComponentScan-covered files don't register as ABI changes IC can see). strictSafety = true still works everywhere; the new escape hatch for a genuine detector misfire (the marker appears only in a comment/string, not a real entry point) is strictSafetyForceOff = true — a separate,

... (truncated)

Commits

• 5b3ccb3 Merge pull request #79 from InsertKoinIO/a3-completion
• 18288be fix(a3): KOIN-D001's fallback module label hardcoded "(startKoin)" for every ...
• f2cbe3e docs: fix stale A2 wording in PR Guard #3 procedure, tighten hint-collision r...
• 7f4353e docs: release-note the orphan-module fix, flag a stale PR Guard #3 edit for a...
• f4222e5 fix(a3): orphaned @​Module classes were silently treated as reachable from any...
• 944ec99 chore: release 1.1.0
• 3589760 docs: reconcile compile-safety docs with the A2 removal
• 4e05430 test(a3): regression coverage for the A2 removal — peer providers, qualifier/...
• 2980801 fix(a3): remove A2 entirely — A3 full-graph validation is now the sole compil...
• f91c396 feat: allWarningsAsErrors compatibility + mandatory strictSafety on detected ...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Looks like io.insert-koin.compiler.plugin is up-to-date now, so this is no longer needed.