How tightly is ktor and kotlinx.serialization integrated? Ktor uses kotlinx.serialization 1.3.3 afaict but there is a stable 1.4.1 and even a 1.5.0 out. Is it generally considered safe to upgrade? Is it possible?

So far I always upgrade both to the latest version and have had no issues. I've been doing that for at least 2 years now, so I'm fairly confident there's not much risk (but no promises)

1.4.1 worked seemingly fine on latest ktor at least

I would be worried about the Ktor 1.0 → 2.0 migration, but as long as you're past that, I don't think there's any reason to worry.