JetBrains is introducing a formal 18-month security support policy for the Kotlin standard library (JVM kotlin-stdlib), starting with Kotlin 2.4. Each release line receives security backports for 18 months from its .0 release date, with patches published simultaneously across all active supported lines. The policy addresses a gap for organizations in regulated industries (finance, banking) that require documented support windows for compliance reviews. Scope is limited to the JVM runtime artifact; compile-time tooling is excluded. CVEs will be assigned where applicable, and a dedicated support page on kotlinlang.org will track active lines and end-of-support dates. Teams are advised to pin their stdlib version explicitly to ensure the patched version is resolved correctly by Gradle or Maven.
