[gf000]

> Most mature Java project has moved to Kotlin.

Demonstrably false, not even close

Re Gradle using groovy/kotlin: so what? Gradle is not a standard any more than Maven, and java is not primary used as a scripting language, so it makes sense that it has a different language for its config files? What's the deal here?

Show me a language without vulnerabilities.

It has virtual threads for quite some times and it is a much much better choice for most use cases than async.

[ActorNightly]

>Demonstrably false, not even close

Are you arguing that the Android Ecosystem uses Java? Because it most certainly moved to Kotlin, and will soon move even off of that.

>Show me a language without vulnerabilities.

There is a scale of vulnerability severeness in terms of severity and how the vulnerability was introduced.

Most every language has libraries with bugs that can create vulnerability. Log4shell wasn't a bug - it was introduced intentionally without anyone at Apache looking at it and thinking that it was wrong, knowing that log4j is the most widely used logging library for java.

[gf000]

> Are you arguing that the Android Ecosystem uses Java

Now you are just arguing in bad faith. Who talks about Android, which historically lagged a decade behind OpenJDK and not particularly good at being up to date even today, so people moved to kotlin vs java without goddamn lambdas? Is that your argument? Especially that it's a tiny segment compared to the vastness of web backends. Are Google's, apple's, alibaba's backends, amazon cloud etc insignificant in your mind?

And you may want to browse the list of vulnerabilities, there are plenty interesting ones.