> ## Documentation Index
> Fetch the complete documentation index at: https://repost.sh/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Kotlin Compatibility and Security

> The supported Kotlin, Gradle, JDK, and framework matrix for the Repost Kotlin client, plus the shared security baseline.

| Axis           | Supported                                                                                        |
| -------------- | ------------------------------------------------------------------------------------------------ |
| **Kotlin**     | Language/API 2.1 (emitted). Compiler baseline 2.1.21, current 2.4.0.                             |
| **Gradle**     | Wrapper 8.12.1 (minimum); also tested on 8.14.5 and 9.6.0. Kotlin 2.4.0 pairs with Gradle 9.5.0. |
| **JDK**        | 11, 17, 21, 25 (Java 11 bytecode; build with JDK 21).                                            |
| **Frameworks** | Spring Boot 4.0.7/4.1.0, Jakarta CDI 4.0.1, Ktor 3.5.1, Vert.x 4.5.29/5.1.4.                     |
| **Platform**   | Server-side JVM. **No Android** — the client carries a publish credential.                       |

Support status and end-of-life follow the upstream Kotlin, JDK, framework, and Gradle schedules; the pinned lines live in `sdk/jvm/compatibility-matrix.toml` in the release.

## Security posture

The [Java SDK](/docs/send/java/compatibility) documents the shared baseline in full:

* **Proxy, TLS, and mTLS** via `HttpTransportOptions` (explicit proxy with credentials, a borrowed `SSLContext` for mutual TLS, allowlisted TLS 1.2/1.3 and ciphers, redirects disabled) — see [Configuration](/docs/send/kotlin/configuration#proxy-tls-and-mtls).
* **Redaction.** The SDK's own diagnostics, observer events, telemetry, exception messages, and model `toString()` are credential- and payload-free. The SDK does **not** scrub PII you place inside an event payload — that data is the event you publish and is sent to Repost as-is.
* **Native image.** One framework-neutral-core GraalVM native smoke (25.0.3) is validated; the framework modules are not native-certified.
* **FIPS.** This release is **not** FIPS-certified. Using it in a FIPS deployment requires your own certified provider and JDK.

## Continue

<Columns cols={3} className="gap-y-4">
  <Card title="Java SDK" icon="coffee" href="/docs/send/java/quickstart" cta="Java" arrow="true">
    The same runtime with builders, `CompletionStage`, and the Maven plugin.
  </Card>

  <Card title="SDKs" icon="package" href="/docs/send/sdks" cta="All languages" arrow="true">
    The behavior every generated client shares, in every language.
  </Card>

  <Card title="Schema workflow" icon="braces" href="/docs/cli/schema" cta="Schema" arrow="true">
    Version the schema with migrations and deploy it to your environment.
  </Card>
</Columns>