Jetpack Compose 1.12

Last reviewed Sep 19, 2026

Export as PDF

Prompt Details

Prompt Composition

3prompts
  1. Kotlin 2.4116 lines · 3.7K tokens
  2. Android SDK 3655 lines · 1.4K tokens
  3. Jetpack Compose 1.1260 lines · 2.5K tokens
Total231 lines · 7.6K tokens

CWE Coverage

  • 20
  • 22
  • 59
  • 78
  • 79
  • 88
  • 89
  • 94
  • 117
  • 201
  • 208
  • 209
  • 212
  • 250
  • 287
  • 295
  • 297
  • 319
  • 321
  • 323
  • 327
  • 338
  • 346
  • 362
  • 367
  • 378
  • 470
  • 471
  • 476
  • 489
  • 494
  • 502
  • 532
  • 540
  • 611
  • 732
  • 770
  • 772
  • 789
  • 807
  • 829
  • 862
  • 863
  • 915
  • 916
  • 918
  • 922
  • 923
  • 926
  • 927
  • 1333

Prompt Preview

Apply the Kotlin 2.4 and Android SDK 36 prompts first. These rules cover the 1.12 line of AndroidX Compose UI, runtime, foundation, and Material 2 on Android, plus their navigation and lifecycle integration, and were checked against 1.12.0. The Android SDK 36 baseline supplies target-SDK security policy; it does not set Compose's compilation or minimum-device requirements.

Versions and build configuration

  • Compose 1.12.0 requires compileSdk 37 or higher and AGP 9.2.0 or higher, and its Android minimum is API 23, subject to any higher requirement of the resolved dependencies. Keep targetSdk separate and do not bypass dependency compatibility checks.
  • Resolve a coherent dependency set using a pinned stable Compose BOM or explicit compatible artifact versions. Inspect overrides and transitive resolution; the BOM does not version the Kotlin compiler, Navigation, Lifecycle, or Activity, and Material 3 has its own version line.
  • Apply org.jetbrains.kotlin.plugin.compose in each Compose module at the same version as Kotlin. Do not copy legacy kotlinCompilerExtensionVersion = "1.5.15" configuration into a Kotlin 2.4 build.

State ownership and restoration

  • Keep credentials and confidential records out of rememberSaveable, custom Saver output, and SavedStateHandle. Save only bounded, non-secret UI metadata or identifiers; these APIs use saved-instance-state bundles, not protected credential storage.
  • Avoid rememberTextFieldState() for secret input that must not survive recreation: it includes saving and restoration. Use an explicitly owned, unsaved