RUN-0000: Force kotlin-stdlib to 2.1.0 to fix CVE-2020-29582

[fdevans]

Summary

• kotlin-stdlib is pulled in transitively via okhttp/okio/logging-interceptor and was resolving to 1.9.10, vulnerable to CVE-2020-29582 (Snyk: SNYK-JAVA-ORGJETBRAINSKOTLIN-2393744).
• Adds a resolutionStrategy.force in build.gradle to pin kotlin-stdlib, -jdk7, -jdk8, and -common to 2.1.0 (fixed version), following the same pattern already used there for the commons-compress CVE mitigation.
• Updates gradle/verification-metadata.xml with checksums for the new artifact versions (repo uses Gradle dependency verification).

Test plan

• ./gradlew --write-verification-metadata sha256 compileJava compileGroovy compileTestJava compileTestGroovy — compiles cleanly with new checksums
• ./gradlew test — full test suite passes
• ./gradlew :rd-cli-tool:shadowJar — shadow jar build succeeds
• dependencyInsight --dependency kotlin-stdlib confirms all paths resolve to 2.1.0

[Copilot]

Pull request overview

Pins transitive Kotlin standard library dependencies to a non-vulnerable version across all subprojects to mitigate CVE-2020-29582, and updates Gradle dependency verification metadata accordingly.

Changes:

• Forces org.jetbrains.kotlin:kotlin-stdlib* modules to 2.1.0 via resolutionStrategy.force in build.gradle.
• Adds SHA-256 entries for the newly resolved Kotlin artifacts in gradle/verification-metadata.xml.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
build.gradle	Forces Kotlin stdlib-related modules to 2.1.0 across subprojects to ensure vulnerable transitive versions are not selected.
gradle/verification-metadata.xml	Updates dependency verification metadata with checksums for Kotlin 2.1.0 artifacts.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[jtobard]

Deep review — ran this locally against the PR branch (isolated clone) rather than just reading the diff:

• ./gradlew :rd-cli-tool:dependencyInsight --dependency kotlin-stdlib --configuration compileClasspath confirms every transitive path (okhttp, okio, logging-interceptor, retrofit) resolves to 2.1.0, all "Forced" — no conflicts.
• ./gradlew --write-verification-metadata sha256 ... produced a zero diff on gradle/verification-metadata.xml, confirming the committed checksums are correct/complete.
• compileJava/compileGroovy/compileTestJava/compileTestGroovy — clean.
• ./gradlew test — full suite passes.
• :rd-cli-tool:shadowJar — builds successfully; inspected the jar, single consistent kotlin-stdlib version bundled.

kotlin-stdlib is only a transitive dependency here (not called directly), and 1.9.10 → 2.1.0 carries low practical risk given Kotlin's strong binary/source compat guarantees for Java-interop-only consumers. Change is minimal and follows the existing commonsCompress force pattern (see #591).

One cosmetic nit (non-blocking): the title/commit use placeholder RUN-0000 — #591 (the commons-compress CVE fix) used a real ticket (RUN-3602) with the same phrasing, might be worth swapping in a real ticket number before merge.

LGTM.