gRPC Kotlin 1.5

Last reviewed Sep 19, 2026

Export as PDF

Prompt Details

Prompt Composition

3prompts
  1. Java 17109 lines · 4.4K tokens
  2. Kotlin 2.4116 lines · 3.7K tokens
  3. gRPC Kotlin 1.566 lines · 3.5K tokens
Total291 lines · 11.6K tokens

CWE Coverage

  • 20
  • 22
  • 59
  • 78
  • 79
  • 88
  • 89
  • 90
  • 94
  • 95
  • 117
  • 190
  • 201
  • 208
  • 209
  • 214
  • 250
  • 287
  • 295
  • 297
  • 306
  • 319
  • 323
  • 327
  • 338
  • 346
  • 347
  • 354
  • 362
  • 367
  • 378
  • 427
  • 459
  • 470
  • 471
  • 476
  • 494
  • 502
  • 532
  • 540
  • 611
  • 653
  • 732
  • 770
  • 772
  • 776
  • 807
  • 829
  • 862
  • 863
  • 915
  • 916
  • 918
  • 922
  • 923
  • 1287
  • 1333

Prompt Preview

Apply the Java 17 and Kotlin 2.4 prompts first. These rules cover gRPC Kotlin 1.5 coroutine services and stubs on the JVM and were checked against 1.5.0. The release builds with Kotlin 2.2.20, Java 17 bytecode, and coroutines 1.10.2, and declares gRPC Java 1.62.2. Those upstream build versions establish API scope; they do not establish safe production dependency pins or certify the application's Kotlin 2.4 integration.

Runtime and dependency boundaries

  • Use a supported, patched Java 17 runtime for these rules; the 1.5.0 JVM artifacts target Java 17, so an older gRPC Java runtime requirement does not make them Java 8-compatible. Validate another JDK, Kotlin compiler, or coroutines version with the generated stubs and actual transport before deploying it.
  • Keep grpc-kotlin-stub and protoc-gen-grpc-kotlin on the same release, recorded in the lockfile, and move them together; keep gRPC Java modules aligned, and generate from reviewed .proto files. Keep Java protobuf generated code and its runtime within the official compatibility window; never run newer generated code against an older protobuf runtime.
  • Choose gRPC Kotlin versions from the project's numbered release tags. Maven Central's <latest> and <release> metadata for both artifacts name a stray April 2025 build whose version is a commit hash, so don't accept that build from a version lookup or an update bot, and don't resolve these artifacts with a dynamic version such as + or latest.release.
  • Replace vulnerable transitive pins with compatible patched dependencies. The tag's protobuf 3.25.3 and