Shaded Kotlin version (1.8.0) is EOL — please upgrade to supported Kotlin release

Description

The newrelic-agent-9.3.0.jar bundles a shaded copy of Kotlin 1.8.0. According to https://endoflife.date/kotlin, Kotlin 1.8.x is end-of-life and no longer receives security patches. Enterprise security scanners (e.g. Black Duck) flag this as an EOL component in the shipped product distribution, blocking compliance sign-off. Since the Kotlin runtime is shaded inside the agent jar and there is no way for consumers to override or exclude it, this can only be resolved by the NewRelic team upgrading to a currently supported Kotlin release.

Expected Behavior

newrelic-agent should bundle a Kotlin version that is within its active support window per https://endoflife.date/kotlin

Agent version:

9.3.0

Java version:

Java 17

Operating system:

Linux

Steps to reproduce / evidence:

Download newrelic-agent-9.3.0.jar
Run: unzip -l newrelic-agent-9.3.0.jar | grep kotlin
Observe shaded Kotlin classes present at version 1.8.0
Cross-reference against https://endoflife.date/kotlin — 1.8.x is EOL

Additional context:

This is flagged by Black Duck SCA scanning as an EOL component in our product distribution. We cannot exclude the agent jar as it is a mandatory cloud operations monitoring requirement. We have no remediation path available without a fix from NewRelic. Requesting this be addressed in a future agent release.

Start by inspecting newrelic-agent-9.3.0.jar with unzip -l ... | grep kotlin and trace the build dependency that supplies the shaded Kotlin classes. Confirm which supported Kotlin release can be bundled without breaking the Java agent, then verify the rebuilt agent no longer contains Kotlin 1.8.0 and passes the project checks.