Ktor 3.6.0 turns the auth provider into a value the route can type-check

`authenticateWith(jwtAuth)` takes the provider, not its name. In the sample JetBrains published, `jwt<User>("my-jwt")` is assigned to a val, and the route block references that val, so the principal type travels with it: the sample reads `val user = call.principal`, with no type argument and no cast ^[5]. JetBrains describes the older arrangement as implicit typing bridging configuration to routes, and the new module as types that guarantee full type safety when working with complex authentication ^[2].

The elegant part of that syntax depends on Kotlin context parameters, according to the release post ^[4]. So the Kotlin version in your build constrains this upgrade as much as the Ktor version does.

The OpenID Connect plugin follows the same shape. `install(Oidc)` returns a value, `identityProvider("auth0")` declares an issuer and a `bearer` block with an audience set, and the route authenticates against `auth0.jwtBearer` before reading `call.principal.claims.subject` ^[6]. Providers are typed, and JetBrains says the plugin supports all OpenID Connect features in a typed way ^[6].

`enableHttp3 { }` does not stand alone. The documented order is an SSL connector first, then the opt-in block ^[8]; in the sample that connector listens on port 8443 ^[18]. QUIC is carried over UDP, which is why the block exposes UDP socket configuration at all ^[9], and it means 8443 has to be open for UDP on every hop in front of the service, not just TCP. JetBrains did not publish latency or throughput figures for the HTTP/3 path, so there is no vendor number here to test against your own traffic. Feedback is explicitly requested ^[10], which is the polite way of saying the API can still move.

The two deprecations are ordinary maintenance. `ApplicationCall.receive()` now accepts nullable types, and `receiveNullable()` is deprecated in consequence ^[13]. `respondHtmlPartial` replaces the deprecated `respondHtmlFragment` and uses `TagConsumer<Appendable>`, so it can emit partial HTML with every element `FlowContent` supports ^[14]. Parameter conversion also covers Kotlin's `Uuid`, `Byte` and the unsigned numeric types, which makes `val id: Uuid by call.parameters` work in a route ^[12].

On the client side, ContentNegotiation used to merge its registered content types into every `Accept` header ^[15]. With `ContentTypeMergeStrategy.SkipIfPresent`, an explicit `Accept` header wins, and requests without one still get the registered types added ^[15]. Anyone carrying an interceptor to undo that merge for one strict API can drop it. The cheap way to test the rest is a throwaway project from the generator at start.ktor.io with one protected route ^[16].