## Supported Versions

Security updates are applied to the latest feature release (1.x) of the compiler, standard library, and build plugins.

A fix will be shipped with the next incremental (1.x.y) or bug fix release (1.x.yz).

All fixes are also applied to the master branch to be included in all upcoming releases.

## Reporting a Vulnerability

`Dependency verification failed` errors when local artifacts are absent or have different hashes listed in the
[verification-metadata.xml](https://github.com/JetBrains/kotlin/blob/master/gradle/verification-metadata.xml) file.

It's expected that `verification-metadata.xml` should only be updated with the commits that modify the build. There are some tips how
to perform such updates:

internal object FirReferenceResolveHelper {
    fun FirResolvedTypeRef.toTargetSymbol(session: FirSession, symbolBuilder: KtSymbolByFirBuilder): KtSymbol? {
        // When you call a method from Java with type arguments, in FIR they are currently represented as flexible types.
        // TODO Consider handling other non-ConeLookupTagBasedType types here (see KT-66418)
        val type = getDeclaredType()?.lowerBoundIfFlexible() as? ConeLookupTagBasedType

 * stub-indexing binary libraries). And in general, querying the symbol names provider might be faster since its sets are cached, which is
 * not necessarily the case for declaration providers (e.g. the IDE declaration provider hitting the index without caching).
 *

        /**
         * A scope containing both non-static and static members. A smart combined scope (as opposed to a naive combination of [KtScope]s
         * with [getCompositeScope]) avoids duplicate inner classes, as they are contained in non-static and static scopes.
         *
         * A proper combined declared member scope kind also makes it easier to cache combined scopes directly (if needed).
         */
        COMBINED,
    }

        if (!hasAnnotations) return false

        // Check the simple names of the Java annotations. While presence of such an annotation name does not prove deprecation, it is a
        // necessary condition for it. Type aliases are not a problem here: Java code cannot access Kotlin type aliases. (Currently,
        // deprecation annotation type aliases do not work in Kotlin, either, but this might change in the future.)

                // The main file needs to be the last so caches for the context declarations are populated in FIR-to-IR.
                remove(file)
            }

            addAll(dependencyFiles)
            add(file)
        }

        // Files in the code fragment context module are compiled together with the code fragment itself.

            // Type parameters, return types and other annotations are all contained in KtUserType,
            // and are never considered used as expressions
            is KtUserType ->
                false

            // Only top-level named declarations have KtFile/KtScript Parents, and are never considered used
            is KtFile ->
                false
            is KtScript ->

    append("(")
    if (method.containingClass?.isEnum == true && method.isConstructor) {
        // Enum constructors are represented without name/ordinal in light classes, which seems fine because they don't have name/ordinal
        // in Java sources as well, even though the parameters are there in the bytecode. Since metadata stores JVM signatures, we're
        // adding the name/ordinal parameters manually.

            } else null
        }
    }
    val unavailableLocalTypes = localTypes.filterNot { it.isLocalButAvailableAtPosition(session, useSitePosition) }
    // Need to approximate if there are local types that are not available in this scope
    return localTypes.isNotEmpty() && unavailableLocalTypes.isNotEmpty()
}

// Mimic FirDeclaration.visibilityForApproximation