The current Kotlin version used by OpenSearch plugins appears to be on an unsupported release stream.
Kotlin 2.3 is no longer the current supported release stream, while Kotlin 2.4.x is actively maintained and receives fixes.
Organizations performing software composition analysis and security reviews flag unsupported language toolchains and build dependencies, creating compliance issues for product releases based on OpenSearch.
Kotlin 2.4 is the latest stable release stream and Kotlin 2.3 is no longer the current supported stream.
Proposal
Upgrade all Kotlin-based OpenSearch plugins from Kotlin 2.3.x or lower to Kotlin 2.4.x.
Goals:
- Align with currently supported Kotlin releases.
- Reduce dependency lifecycle risk.
- Validate build, test, and runtime compatibility.
- Publish migration guidance for plugin maintainers.
Unsupported language toolchains may result in compliance findings even when no CVE is present.
Could the project provide:
- a committed target release,
- an estimated milestone,
- or a documented rationale for continued use of the current Kotlin version.