Refresh deps to latest stable: kotlinx-serialization 1.10.0→1.11.0, ksrpc 1.1.4→1.1.5, binary-compatibility-validator 0.18.0→0.18.1

[monkopedia-coder]

Code-health suggestion (proactive — staged for your review)

Category: dep-bump

Where: gradle/libs.versions.toml

coordinate	current	latest stable	jump	note
org.jetbrains.kotlinx:kotlinx-serialization-json	1.10.0	1.11.0	minor	used by :krapper, :krapper_model, and the Gradle plugin — and shaded into the published plugin jar (compiler/gradle/build.gradle.kts, #194), so this version ships to consumers
com.monkopedia.ksrpc:ksrpc-core / ksrpc-sockets	1.1.4	1.1.5	patch	first-party; same shading note — the wire between the plugin and the bundled krapper
org.jetbrains.kotlinx.binary-compatibility-validator (plugin)	0.18.0	0.18.1	patch	the ABI gate on both published coordinates

Current and correct, for the record: kotlin 2.4.10, coroutines 1.11.0, clikt 5.1.0, ktlint-gradle 14.2.0, ktlint-cli 1.8.0, klinker 0.2.0, gradle-plugin-publish 2.1.1, vannik 0.37.0, shadow 9.6.1. Gradle itself (9.6.1 vs 9.7.1) and the CI action majors are deliberately excluded here — they belong to #207.

Method (maven-metadata.xml only; the <latest>/<release> fields and solrsearch are both ignored). Each candidate is matched against the shape of the version already pinned, so a suffixed release line stays on its line, and any result lower than the current pin is treated as a bug in the check rather than as an upgrade:

suf=$(printf '%s' "$cur" | sed -E 's/^[0-9]+(\.[0-9]+)*//')      # "" or "-jre"
curl -s "$url" | grep -o '<version>[^<]*' | sed 's/<version>//' \
  | grep -xE "[0-9]+(\.[0-9]+)*${suf}" | sort -V | tail -1

org/jetbrains/kotlinx/kotlinx-serialization-json  HTTP=200 n=36   suffix=''      1.10.0     -> 1.11.0
com/monkopedia/ksrpc/ksrpc-core                   HTTP=200 n=36   suffix=''      1.1.4      -> 1.1.5
com/google/guava/guava                            HTTP=200 n=158  suffix='-jre'  33.5.0-jre -> 33.7.1-jre
bcv plugin marker (plugins.gradle.org)            HTTP=200 n=34                  0.18.0     -> 0.18.1

Every query returned HTTP 200 with a non-empty <version> list; none produced a downgrade. Nothing was left unanswered.

On guava (deliberately NOT in the table above): it resolves to 33.7.1-jre, but the alias is dead — com.google.guava:guava appears in the catalog and nowhere else in the 535 tracked files, alongside coroutines-debug and kotlin-gradle-plugin (the latter with the same coordinate hardcoded off-catalog at compiler/gradle/build.gradle.kts:89). Those three are the same class as the dead klinker pin in #225 and belong to that work, not to a routine bump — the right change there is to delete the entries, not to raise them. Refs #225.

Proposed: raise the three rows in the table to latest stable in gradle/libs.versions.toml (serialization = "1.11.0", ksrpc = "1.1.5", binary-compatibility-validator = "0.18.1") and let -p compiler check + the root build verify.

Two sequencing notes for the reviewer, since two of these are shaded into a published jar:

• serialization and ksrpc move together with :krapper's wire protocol — the plugin and the bundled tool are compiled from the same source and must agree, so this is one atomic bump, not three.
• A bcv bump can legitimately change what apiCheck reports. If the .api dumps move, that diff should be read rather than apiDump-ed away.

Why: staying on latest stable avoids a painful multi-version catch-up later; two of the three are on the runtime path that actually ships inside kplusplus-compiler-gradle.

Effort: mechanical

Filed by the nightly code-health pass. To act on it: relabel agent-workable (it'll flow into triage→work). To decline: close it — it won't be suggested again.