Support status and end-of-life follow the upstream JDK, framework, and build-tool schedules; see
sdk/jvm/compatibility-matrix.toml in the release for the pinned lines.
Security posture
- Dependencies. The runtime carries a source-verified, relocated Apache HttpClient/HttpCore baseline and JSpecify annotations — nothing else leaks onto your classpath. The
micrometer,opentelemetry, Spring, and Jakarta APIs are needed only when you use those modules. - Proxy, TLS, and mTLS. Configured through
HttpTransportOptions— see Configuration. HTTP redirects are disabled. - Redaction. The SDK’s own diagnostics, observer events, telemetry, exception messages, and model
toString()are credential- and payload-free — a model renders only its type and the names of set fields, never their values, and an exception message is a fixed string keyed on the error code. The SDK does not scrub PII you place inside an event payload; that data is the event you are publishing and is sent to Repost as-is. - Native image. One framework-neutral-core GraalVM native smoke (25.0.3) is validated; native support for the framework modules is not certified.
- FIPS. This release is not FIPS-certified. It uses the platform JCA and standard TLS; using it in a FIPS deployment requires your own certified provider and JDK.
Continue
Kotlin SDK
The same runtime with a coroutine DSL, the Gradle plugin, and Ktor.
SDKs
The behavior every generated client shares, in every language.
Schema workflow
Version the schema with migrations and deploy it to your environment.