> ## Documentation Index
> Fetch the complete documentation index at: https://repost.sh/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Java Compatibility and Security

> The supported JDK, build-tool, and framework matrix for the Repost Java client, plus the dependency, redaction, native-image, and FIPS posture.

| Axis                           | Supported                                                                                           |
| ------------------------------ | --------------------------------------------------------------------------------------------------- |
| **JDK**                        | 11, 17, 21, 25 (current security-update builds). The client is Java 11 bytecode; build with JDK 21. |
| **Build tools**                | Maven 3.9.0+ (pinned current 3.9.16); Gradle via the [Kotlin SDK](/docs/send/kotlin/quickstart).         |
| **Spring Boot**                | 4.0.7 (compiled), 4.1.0 (verified), on JDK 17/21/25.                                                |
| **Jakarta CDI / MicroProfile** | CDI 4.0.1, MicroProfile Config 3.1 (WildFly, Open Liberty, Payara).                                 |
| **Vert.x**                     | 4.5.29, 5.1.4 (certified).                                                                          |
| **Quarkus / Micronaut**        | Framework-neutral core only (no dedicated extension or native image yet).                           |
| **Platform**                   | Server-side JVM. **No Android** — the client carries a publish credential.                          |

Support status and end-of-life follow the upstream JDK, framework, and build-tool schedules; see `sdk/jvm/compatibility-matrix.toml` in the release for the pinned lines.

## Security posture

* **Dependencies.** The runtime carries a source-verified, relocated Apache HttpClient/HttpCore baseline and JSpecify annotations — nothing else leaks onto your classpath. The `micrometer`, `opentelemetry`, Spring, and Jakarta APIs are needed only when you use those modules.
* **Proxy, TLS, and mTLS.** Configured through `HttpTransportOptions` — see [Configuration](/docs/send/java/configuration#proxy-tls-and-mtls). HTTP redirects are disabled.
* **Redaction.** The SDK's own diagnostics, observer events, telemetry, exception messages, and model `toString()` are credential- and payload-free — a model renders only its type and the names of set fields, never their values, and an exception message is a fixed string keyed on the error code. The SDK does **not** scrub PII you place inside an event payload; that data is the event you are publishing and is sent to Repost as-is.
* **Native image.** One framework-neutral-core GraalVM native smoke (25.0.3) is validated; native support for the framework modules is not certified.
* **FIPS.** This release is **not** FIPS-certified. It uses the platform JCA and standard TLS; using it in a FIPS deployment requires your own certified provider and JDK.

## Continue

<Columns cols={3} className="gap-y-4">
  <Card title="Kotlin SDK" icon="feather" href="/docs/send/kotlin/quickstart" cta="Kotlin" arrow="true">
    The same runtime with a coroutine DSL, the Gradle plugin, and Ktor.
  </Card>

  <Card title="SDKs" icon="package" href="/docs/send/sdks" cta="All languages" arrow="true">
    The behavior every generated client shares, in every language.
  </Card>

  <Card title="Schema workflow" icon="braces" href="/docs/cli/schema" cta="Schema" arrow="true">
    Version the schema with migrations and deploy it to your environment.
  </Card>
</Columns>