Dependencies

The Kotlin repository pulls in a relatively small number of large external dependencies plus a long tail of small ones. All dependency hashes are pinned in gradle/verification-metadata.xml (over 50 modifications in the last 90 days as the project absorbs upstream version bumps).

Major dependencies

Dependency	Where it's used	Notes
intellij-core	All compiler modules — provides the PSI API, Disposer, lightweight project model.	Pulled from JetBrains' IntelliJ Platform distribution. Versioned in intellij.yaml.
idea-full	The plugin module and some testing fixtures.	A full IntelliJ IDEA Community jar set. Large download on first build.
ASM	JVM backend (compiler/ir/backend.jvm/)	Bytecode emission. Vendored under dependencies/.
LLVM	Kotlin/Native backend (kotlin-native/)	Vendored. See kotlin-native/dependencies/ and kotlin-native/BUILDING_LLVM.md.
libclang	Native cinterop tool (kotlin-native/Interop/)	Used to parse C/Objective-C headers.
Protobuf	Kotlin metadata format and various plugin protocols.	Standard protobuf-java plus protobuf-lite.
kotlinx.coroutines	Some build-time tooling (KGP integration tests, scripting).	Standard Maven Central. The runtime ships separately.
kotlinx.serialization (runtime)	Some build-time tooling.	Plugin in this repo, runtime separate.
Maven Resolver / Aether	libraries/scripting/dependencies-maven/	Resolve script-declared dependencies.
JUnit 4 / JUnit 5 / TestNG	Test runners.	Standard.
Mockito, AssertJ	Some test code.	Standard.
Apache Commons	A few utility uses.	Standard.
Gradle API	KGP, KGP-API.	Provided by Gradle at runtime.
Apache Maven (plugin model)	libraries/kotlin-maven-plugin/.	Pulled by the Maven build, not the Gradle one.
JNA	Native interop in some places.	Standard.

Bootstrap

The compiler in this repository is compiled by an earlier Kotlin compiler — the bootstrap. The bootstrap version is pinned in gradle.properties and resolved from https://redirector.kotlinlang.org/maven/bootstrap. The bootstrap is rolled forward periodically; commits that change it carry a [Bootstrap] prefix.

Dependency verification

Every artifact resolved by Gradle has its md5 and sha256 hashes pinned in gradle/verification-metadata.xml. To regenerate after a dependency change:

./scripts/update-verification-metadata.sh

This clears the <components> section and re-runs Gradle's --write-verification-metadata sha256 for the resolveDependencies task (with -Pkotlin.native.enabled=true to cover all targets).

If you add a dependency whose artifact name includes a platform suffix (darwin, mac, osx, linux, windows), also update implicitDependencies in the corresponding build script — resolveDependencies should resolve dependencies for all platforms, not just the host.

Native dependencies (Kotlin/Native only)

kotlin-native/dependencies/ pulls in:

• A vendored LLVM (with patches; built per-host).
• libclang.
• Platform-specific runtime headers and libraries.

The Native build also expects an OS-level toolchain: Xcode on macOS, Visual Studio on Windows, and a glibc/musl-based toolchain on Linux. See kotlin-native/HACKING.md and kotlin-native/README.md.

Cache redirector

gradle/cacheRedirector.settings.gradle.kts configures a JetBrains-hosted artifact redirector that mirrors Maven Central, the Gradle plugin portal, and other public repositories. This protects against upstream availability issues and speeds up builds within the JetBrains network.

NPM and JS dependencies

Kotlin/JS pulls in a small number of npm packages for tooling (Karma, Webpack, Mocha, ...). They're managed via kotlin-js-store/ (lockfile) at the repo root, in concert with js/npm/ and libraries/tools/kotlin-gradle-plugin/.../js/.

Third-party

The third-party/ directory at the repo root holds vendored copies of external sources — small libraries that are easier to vendor than depend on. Each subdirectory has its own license file under third-party/<name>/LICENSE.txt.

License of third-party dependencies

Each licensed dependency is enumerated in license/ (root-level, alongside Kotlin's own license). The set is checked at build time to ensure no GPL or otherwise incompatible-licensed library makes it into the distribution.