http4s
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -15,56 +15,42 @@ on:
     tags: [v*]
 
 env:
-  PGP_PASSPHRASE: ${{ secrets.PGP_PASSPHRASE }}
-  SONATYPE_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }}
-  SONATYPE_CREDENTIAL_HOST: ${{ secrets.SONATYPE_CREDENTIAL_HOST }}
-  SONATYPE_USERNAME: ${{ secrets.SONATYPE_USERNAME }}
-  PGP_SECRET: ${{ secrets.PGP_SECRET }}
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
+
+concurrency:
+  group: ${{ github.workflow }} @ ${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build:
     name: Build and Test
     strategy:
       fail-fast: false
       matrix:
         os: [ubuntu-latest]
-        scala: [3.2.2, 2.12.17, 2.13.10]
+        scala: [3, 2.12, 2.13]
         java: [temurin@8]
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 60
     steps:
       - name: Checkout current branch (full)
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
-      - name: Download Java (temurin@8)
-        id: download-java-temurin-8
-        if: matrix.java == 'temurin@8'
-        uses: typelevel/download-java@v2
-        with:
-          distribution: temurin
-          java-version: 8
-
       - name: Setup Java (temurin@8)
+        id: setup-java-temurin-8
         if: matrix.java == 'temurin@8'
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@v4
         with:
-          distribution: jdkfile
+          distribution: temurin
           java-version: 8
-          jdkFile: ${{ steps.download-java-temurin-8.outputs.jdkFile }}
+          cache: sbt
 
-      - name: Cache sbt
-        uses: actions/cache@v3
-        with:
-          path: |
-            ~/.sbt
-            ~/.ivy2/cache
-            ~/.coursier/cache/v1
-            ~/.cache/coursier/v1
-            ~/AppData/Local/Coursier/Cache/v1
-            ~/Library/Caches/Coursier/v1
-          key: ${{ runner.os }}-sbt-cache-v2-${{ hashFiles('**/*.sbt') }}-${{ hashFiles('project/build.properties') }}
+      - name: sbt update
+        if: matrix.java == 'temurin@8' && steps.setup-java-temurin-8.outputs.cache-hit == 'false'
+        run: sbt +update
 
       - name: Check that workflows are up to date
         run: sbt githubWorkflowCheck
@@ -88,7 +74,7 @@ jobs:
         run: sbt '++ ${{ matrix.scala }}' '${{ matrix.ci }}' javafmtCheckAll
 
       - name: Check scalafix lints
-        if: matrix.java == 'temurin@8' && !startsWith(matrix.scala, '3.')
+        if: matrix.java == 'temurin@8' && !startsWith(matrix.scala, '3')
         run: sbt '++ ${{ matrix.scala }}' 'scalafixAll --check'
 
       - name: Check unused compile dependencies
@@ -97,11 +83,11 @@ jobs:
 
       - name: Make target directories
         if: github.event_name != 'pull_request' && (startsWith(github.ref, 'refs/tags/v') || github.ref == 'refs/heads/main')
-        run: mkdir -p blaze-client/target target blaze-server/target examples/target http/target core/target blaze-core/target testkit/target project/target
+        run: mkdir -p blaze-client/target blaze-server/target http/target core/target blaze-core/target project/target
 
       - name: Compress target directories
         if: github.event_name != 'pull_request' && (startsWith(github.ref, 'refs/tags/v') || github.ref == 'refs/heads/main')
-        run: tar cf targets.tar blaze-client/target target blaze-server/target examples/target http/target core/target blaze-core/target testkit/target project/target
+        run: tar cf targets.tar blaze-client/target blaze-server/target http/target core/target blaze-core/target project/target
 
       - name: Upload target directories
         if: github.event_name != 'pull_request' && (startsWith(github.ref, 'refs/tags/v') || github.ref == 'refs/heads/main')
@@ -117,114 +103,132 @@ jobs:
     strategy:
       matrix:
         os: [ubuntu-latest]
-        scala: [2.13.10]
         java: [temurin@8]
     runs-on: ${{ matrix.os }}
     steps:
       - name: Checkout current branch (full)
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
-      - name: Download Java (temurin@8)
-        id: download-java-temurin-8
+      - name: Setup Java (temurin@8)
+        id: setup-java-temurin-8
         if: matrix.java == 'temurin@8'
-        uses: typelevel/download-java@v2
+        uses: actions/setup-java@v4
         with:
           distribution: temurin
           java-version: 8
+          cache: sbt
 
-      - name: Setup Java (temurin@8)
-        if: matrix.java == 'temurin@8'
-        uses: actions/setup-java@v3
-        with:
-          distribution: jdkfile
-          java-version: 8
-          jdkFile: ${{ steps.download-java-temurin-8.outputs.jdkFile }}
+      - name: sbt update
+        if: matrix.java == 'temurin@8' && steps.setup-java-temurin-8.outputs.cache-hit == 'false'
+        run: sbt +update
 
-      - name: Cache sbt
-        uses: actions/cache@v3
-        with:
-          path: |
-            ~/.sbt
-            ~/.ivy2/cache
-            ~/.coursier/cache/v1
-            ~/.cache/coursier/v1
-            ~/AppData/Local/Coursier/Cache/v1
-            ~/Library/Caches/Coursier/v1
-          key: ${{ runner.os }}-sbt-cache-v2-${{ hashFiles('**/*.sbt') }}-${{ hashFiles('project/build.properties') }}
-
-      - name: Download target directories (3.2.2)
+      - name: Download target directories (3)
         uses: actions/download-artifact@v3
         with:
-          name: target-${{ matrix.os }}-${{ matrix.java }}-3.2.2
+          name: target-${{ matrix.os }}-${{ matrix.java }}-3
 
-      - name: Inflate target directories (3.2.2)
+      - name: Inflate target directories (3)
         run: |
           tar xf targets.tar
           rm targets.tar
 
-      - name: Download target directories (2.12.17)
+      - name: Download target directories (2.12)
         uses: actions/download-artifact@v3
         with:
-          name: target-${{ matrix.os }}-${{ matrix.java }}-2.12.17
+          name: target-${{ matrix.os }}-${{ matrix.java }}-2.12
 
-      - name: Inflate target directories (2.12.17)
+      - name: Inflate target directories (2.12)
         run: |
           tar xf targets.tar
           rm targets.tar
 
-      - name: Download target directories (2.13.10)
+      - name: Download target directories (2.13)
         uses: actions/download-artifact@v3
         with:
-          name: target-${{ matrix.os }}-${{ matrix.java }}-2.13.10
+          name: target-${{ matrix.os }}-${{ matrix.java }}-2.13
 
-      - name: Inflate target directories (2.13.10)
+      - name: Inflate target directories (2.13)
         run: |
           tar xf targets.tar
           rm targets.tar
 
       - name: Import signing key
         if: env.PGP_SECRET != '' && env.PGP_PASSPHRASE == ''
-        run: echo $PGP_SECRET | base64 -di | gpg --import
+        env:
+          PGP_SECRET: ${{ secrets.PGP_SECRET }}
+          PGP_PASSPHRASE: ${{ secrets.PGP_PASSPHRASE }}
+        run: echo $PGP_SECRET | base64 -d -i - | gpg --import
 
       - name: Import signing key and strip passphrase
         if: env.PGP_SECRET != '' && env.PGP_PASSPHRASE != ''
+        env:
+          PGP_SECRET: ${{ secrets.PGP_SECRET }}
+          PGP_PASSPHRASE: ${{ secrets.PGP_PASSPHRASE }}
         run: |
-          echo "$PGP_SECRET" | base64 -di > /tmp/signing-key.gpg
+          echo "$PGP_SECRET" | base64 -d -i - > /tmp/signing-key.gpg
           echo "$PGP_PASSPHRASE" | gpg --pinentry-mode loopback --passphrase-fd 0 --import /tmp/signing-key.gpg
           (echo "$PGP_PASSPHRASE"; echo; echo) | gpg --command-fd 0 --pinentry-mode loopback --change-passphrase $(gpg --list-secret-keys --with-colons 2> /dev/null | grep '^sec:' | cut --delimiter ':' --fields 5 | tail -n 1)
 
       - name: Publish
-        run: sbt '++ ${{ matrix.scala }}' tlCiRelease
+        env:
+          SONATYPE_USERNAME: ${{ secrets.SONATYPE_USERNAME }}
+          SONATYPE_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }}
+          SONATYPE_CREDENTIAL_HOST: ${{ secrets.SONATYPE_CREDENTIAL_HOST }}
+        run: sbt tlCiRelease
+
+  dependency-submission:
+    name: Submit Dependencies
+    if: github.event_name != 'pull_request'
+    strategy:
+      matrix:
+        os: [ubuntu-latest]
+        java: [temurin@8]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Checkout current branch (full)
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup Java (temurin@8)
+        id: setup-java-temurin-8
+        if: matrix.java == 'temurin@8'
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: 8
+          cache: sbt
+
+      - name: sbt update
+        if: matrix.java == 'temurin@8' && steps.setup-java-temurin-8.outputs.cache-hit == 'false'
+        run: sbt +update
+
+      - name: Submit Dependencies
+        uses: scalacenter/sbt-dependency-submission@v2
+        with:
+          modules-ignore: blaze_3 blaze_2.12 blaze_2.13 blaze-examples_3 blaze-examples_2.12 blaze-examples_2.13 sbt-http4s-org-scalafix-internal_3 sbt-http4s-org-scalafix-internal_2.12 sbt-http4s-org-scalafix-internal_2.13 blaze-testkit_3 blaze-testkit_2.12 blaze-testkit_2.13
+          configs-ignore: test scala-tool scala-doc-tool test-internal
 
   validate-steward:
     name: Validate Steward Config
     strategy:
       matrix:
         os: [ubuntu-latest]
-        scala: [2.13.6]
         java: [temurin@11]
     runs-on: ${{ matrix.os }}
     steps:
       - name: Checkout current branch (fast)
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
-      - name: Download Java (temurin@17)
-        id: download-java-temurin-17
-        if: matrix.java == 'temurin@17'
-        uses: typelevel/download-java@v2
+      - name: Setup Java (temurin@11)
+        id: setup-java-temurin-11
+        if: matrix.java == 'temurin@11'
+        uses: actions/setup-java@v4
         with:
           distribution: temurin
-          java-version: 17
-
-      - name: Setup Java (temurin@17)
-        if: matrix.java == 'temurin@17'
-        uses: actions/setup-java@v3
-        with:
-          distribution: jdkfile
-          java-version: 17
-          jdkFile: ${{ steps.download-java-temurin-17.outputs.jdkFile }}
+          java-version: 11
 
       - uses: coursier/setup-action@v1
         with:

diff --git a/.scala-steward.conf b/.scala-steward.conf
@@ -1,4 +1,5 @@
 updates.pin = [
   { groupId = "org.slf4j", artifactId = "slf4j-api", version = "1." },
-  { groupId = "ch.qos.logback", artifactId = "logback-classic", version = "1.2." }
+  { groupId = "ch.qos.logback", artifactId = "logback-classic", version = "1.2." },
+  { groupId = "org.scalameta", artifactId = "scalafmt-core", version = "3.6." }
 ]
diff --git a/blaze-client/src/main/scala/org/http4s/blaze/client/BlazeClient.scala b/blaze-client/src/main/scala/org/http4s/blaze/client/BlazeClient.scala
@@ -61,7 +61,7 @@ object BlazeClient {
       dispatcher,
     )
     if (retries > 0)
-      Retry(retryPolicy(retries))(base)
+      Retry(retryPolicy[F](retries))(base)
     else
       base
   }

diff --git a/blaze-client/src/test/scala-2.13/org/http4s/client/blaze/BlazeClient213Suite.scala b/blaze-client/src/test/scala-2.13/org/http4s/client/blaze/BlazeClient213Suite.scala
@@ -97,7 +97,7 @@ class BlazeClient213Suite extends BlazeClientBase {
           }
 
         val allRequests = for {
-          _ <- failedRequests.handleErrorWith(_ => IO.unit).replicateA(5)
+          _ <- failedRequests.recoverWith(_ => IO.pure(List.empty[String])).replicateA(5)
           r <- sucessRequests
         } yield r
 
@@ -134,7 +134,7 @@ class BlazeClient213Suite extends BlazeClientBase {
         }.parSequence
 
         val allRequests = for {
-          _ <- failedRequests.handleErrorWith(_ => IO.unit).replicateA(5)
+          _ <- failedRequests.recoverWith(_ => IO.pure(List.empty[String])).replicateA(5)
           r <- sucessRequests
         } yield r
 

diff --git a/blaze-client/src/test/scala/org/http4s/blaze/client/Http1ClientStageSuite.scala b/blaze-client/src/test/scala/org/http4s/blaze/client/Http1ClientStageSuite.scala
@@ -160,7 +160,7 @@ class Http1ClientStageSuite extends CatsEffectSuite with DispatcherIOFixture {
 
   dispatcher.test("Submit a request line with a query".flaky) { dispatcher =>
     val uri = "/huh?foo=bar"
-    val Right(parsed) = Uri.fromString("http://www.foo.test" + uri)
+    val Right(parsed) = Uri.fromString("http://www.foo.test" + uri): @unchecked
     val req = Request[IO](uri = parsed)
 
     getSubmission(req, resp, dispatcher).map { case (request, response) =>

diff --git a/blaze-core/src/main/scala/org/http4s/blazecore/util/package.scala b/blaze-core/src/main/scala/org/http4s/blazecore/util/package.scala
@@ -16,15 +16,18 @@
 
 package org.http4s
 package blazecore
+package util
 
 import cats.effect.Async
 import org.http4s.blaze.util.Execution.directec
+import org.typelevel.scalaccompat.annotation._
 
 import scala.concurrent.Future
 import scala.util.Failure
 import scala.util.Success
 
-package object util extends ParasiticExecutionContextCompat {
+@nowarn213("msg=package object inheritance is deprecated")
+object `package` extends ParasiticExecutionContextCompat {
 
   /** Used as a terminator for streams built from repeatEval */
   private[http4s] val End = Right(None)

diff --git a/blaze-server/src/test/scala/org/http4s/blaze/server/BlazeServerSuite.scala b/blaze-server/src/test/scala/org/http4s/blaze/server/BlazeServerSuite.scala
@@ -44,6 +44,9 @@ class BlazeServerSuite extends CatsEffectSuite {
 
   override val munitIOTimeout: Duration = 10.seconds
 
+  // allow flaky tests on CI
+  override def munitFlakyOK: Boolean = sys.env.contains("CI")
+
   override implicit lazy val munitIoRuntime: IORuntime = {
     val TestScheduler: ScheduledExecutorService = {
       val s =
@@ -177,7 +180,7 @@ class BlazeServerSuite extends CatsEffectSuite {
     getStatus(server, "/never").assertEquals(Status.ServiceUnavailable)
   }
 
-  blazeServer.test("reliably handle multipart requests") { server =>
+  blazeServer.test("reliably handle multipart requests".flaky) { server =>
     val body =
       """|--aa
              |server: Server, Content-Disposition: form-data; name="a"

diff --git a/build.sbt b/build.sbt
@@ -1,19 +1,19 @@
 import com.typesafe.tools.mima.core._
 import Dependencies._
 
-val Scala212 = "2.12.17"
-val Scala213 = "2.13.10"
-val Scala3 = "3.2.2"
-val http4sVersion = "0.23.19"
-val munitCatsEffectVersion = "2.0.0-M3"
+val Scala212 = "2.12.18"
+val Scala213 = "2.13.12"
+val Scala3 = "3.3.1"
+val http4sVersion = "0.23.24"
+val munitCatsEffectVersion = "2.0.0-M4"
 
 ThisBuild / resolvers +=
   "s01 snapshots".at("https://s01.oss.sonatype.org/content/repositories/snapshots/")
 
 ThisBuild / crossScalaVersions := Seq(Scala3, Scala212, Scala213)
 ThisBuild / scalaVersion := crossScalaVersions.value.filter(_.startsWith("2.")).last
 ThisBuild / tlBaseVersion := "0.23"
-ThisBuild / tlFatalWarningsInCi := !tlIsScala3.value // See SSLStage
+ThisBuild / tlFatalWarnings := !tlIsScala3.value // See SSLStage
 
 // 11 and 17 blocked by https://github.com/http4s/blaze/issues/376
 ThisBuild / githubWorkflowJavaVersions := Seq(JavaSpec.temurin("8"))
@@ -342,7 +342,7 @@ lazy val examples = Project("blaze-examples", file("examples"))
     libraryDependencies ++= Seq(
       "org.http4s" %% "http4s-dsl" % http4sVersion,
       "org.http4s" %% "http4s-circe" % http4sVersion,
-      "io.circe" %% "circe-generic" % "0.14.5",
+      "io.circe" %% "circe-generic" % "0.14.6",
     ),
     Test / scalafixConfig := Some(file(".scalafix.test.conf")),
   )