chore(deps): update dependency com.uber.nullaway:nullaway to v0.13.8

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
com.uber.nullaway:nullaway	0.12.8 → 0.13.8

---

Release Notes

uber/NullAway (com.uber.nullaway:nullaway)

v0.13.8

Compare Source

Mostly minor bug fixes. Note that NullAway now treats Map.remove as returning @Nullable (#​1623), which may lead
to newly-reported warnings.

• Quote syntax element references in error messages by @​AryamannSingh7 (#​1620)
• Fix stream nullability propagation through sorted() (Fixes #​1538) by @​dyrpsf (#​1610)
• Add support for reactor by @​subhramit (#​1599)
• Fix issue with passing poly expression to a function parameter with type from library model (#​1614)
• Fix crash with library model @​Nullable being applied to wildcard (#​1615)
• Add more modeling for Optional (#​1613)
• Update lombok section at README.md by @​jevanlingen (#​1624)
• Model Map.remove as nullable by @​codingkiddo (#​1623)
• Better support for conditional expressions in JSpecify mode (#​1608)
• Fix issue with reading annotations on record constructor parameters due to javac bug (#​1636)
• Maintenance
  • Update to Gradle 9.6.1 and AGP 9.3.0 (#​1634)

v0.13.7

Compare Source

This is a minor bug fix release addressing a couple of issues observed in 0.13.6.

• Add support for filtering null objects from streams in #​1597
• Report init warnings for JPA constructors with arguments in #​1604
• Maintenance
  • Update release instructions in #​1593
  • Switch code coverage aggregation to use built-in jacoco plugin by @​subhramit in #​1598
  • Bump Error Prone to 2.50.0 in #​1601

v0.13.6

Compare Source

(NOTE: originally these notes appeared with the 0.13.5 release, but that release was pushed
incorrectly due to an error in our release process.)

Includes various bug fixes, particularly in JSpecify mode. Also, the nullaway-annotations
artifact now includes a @Contract annotation. NullAway also now has a built-in handler
to reason about field initialization in classes managed by Jakarta Persistence.

Work has begun on support for wildcards in JSpecify mode. Currently, this support is off
by default, guarded by the configuration flag HandleWildcardGenerics. The support still
has multiple known bugs, and we do not yet recommend enabling it.

• Initial subtype checking for wildcards (#​1520)
• Handle subtype checking for wildcard super bounds (#​1547)
• Handle most remaining wildcard subtyping / containment cases (#​1548)
• Test case for #​1528 (#​1556)
• Initial inference for wildcards (#​1549)
• Fix wildcard inference bug with method references (#​1553)
• Fix nullability for return and parameter wildcards (#​1558)
• Test case for trick to assert chain of accesses is non-null (#​1566)
• Improve inference failure error message (#​1567)
• Adjust more TreePaths to have correct leaf before calling getTreeType (#​1570)
• Add Contract annotation to nullaway-annotations by @​codingkiddo (#​1569)
• Run inference for generic method calls nested inside receivers (#​1571)
• Refactor hasAnyAnnotationMatching method (#​1583)
• Improve handling of var-declared local variables (#​1573)
• Compensate for more annotations inserted by javac (#​1574)
• Enable test for issue 1500 and add comment (#​1560)
• Use ground target types when handling lambdas and method refs passed to generic methods (#​1575)
• Fix for unbounded wildcard passed to @NullUnmarked type variable (#​1577)
• Detect and warn on annotations directly on wildcard types (#​1579)
• Enable HandleWildcardGenerics flag when building NullAway (#​1586)
• Report error when @​Initializer is used on a constructor by @​Vinu2111 (#​1546)
• Add a handler for Jakarta Persistence to reason about field initialization (#​1584)
• Revert "Report error when @​Initializer is used on a constructor (#​1546)" (#​1588)
• Maintenance
  • Use Jacoco 0.8.15 snapshot (#​1550)
  • Update to Gradle 9.5.0 (#​1554)
  • Test with latest Error Prone snapshot on CI (#​1555)
  • Add Spring Boot as an integration test (#​1557)
  • Enable generic bytecode tests on JDK 17 (#​1561)
  • Update spotless and guava-latest deps, removed unused semver4j (#​1562)
  • Use text blocks in more tests (#​1563)
  • Use text blocks for addInputLines and addOutputLines calls (#​1564)
  • Use Temurin JDK 17 always in CI (#​1565)
  • Tell agents not to run multiple Gradle builds in parallel (#​1582)
  • Update Codecov action to v6 (#​1587)

v0.13.5

Compare Source

DO NOT USE THIS RELEASE. It was pushed incorrectly due to an error in our release process.
Please use version 0.13.6 instead.

v0.13.4

Compare Source

Fixes a couple of crashes when running NullAway on JDK 27 ea builds. Also modularizes the annotations jar.

• Modularize the annotations JAR by @​anthonyvdotbe (#​1537)
• Test on JDK 27 EA (#​1540)
• Fix crash on JDK 27 (#​1541)
• Maintenance
  • Run regression tests on JDK 26 (#​1526)
  • Refactor ThriftTests and Java8Tests to use addSourceLines instead of deprecated addSourceFile by @​nanookclaw (#​1517)
  • Update to WALA 1.7.1 (#​1539)

v0.13.3

Compare Source

Quick follow-up release to 0.13.2 to fix a crash (#​1523).

• Add @​InjectSoftAssertions to default excluded field annotations by @​is-ivanov (#​1516)
• Fix check for enclosing NewClassTree (#​1524)
• Maintenance
  • Remove onOverrideMethodInvocationVarargsArrayNullability handler method (#​1518)
  • Update to Checker Framework 4.0.0 (#​1519)

v0.13.2

Compare Source

Various bug fixes in this release and better JSpecify support.

• Fix for explicitly-typed lambda parameters in JDK 24+ (#​1452)
• Improve handling of wildcard upper bounds in generic method inference by @​dhruv-agr (#​1454)
• Add default support for @​PostConstruct as an initializer annotation (#​1459)
• Include nested annotation information in astubx files when loading external library models by @​haewiful (#​1456)
• JSpecify: assume NONNULL in generic method inference for unconstrained type variables (#​1471)
• JSpecify: improve inference for generic methods based on method reference arguments (#​1438)
• Improve printing of annotated type variables in error messages (#​1478)
• Initial handling of constructor diamond operators (#​1464)
• Handle restrictive type-use @NonNull annotations on varargs array (#​1484)
• Test case for issue 1493 (#​1496)
• Fix library modeling for varargs arrays (#​1485)
• Re-introduce annotations elided by javac for certain cases (#​1473)
• JDK javac plugin: properly handle nested annotations on array parameter types and varargs (#​1497)
• Print only @Nullable type use annotations in error messages (#​1507)
• Better handling of method references passed to generic methods in JSpecify mode (#​1499)
• Support for Spring's @​Value annotation (#​1505)
• Fix crash with captured array types (#​1508)
• Maintenance
  • Update comments in NullabilityUtil#hasAnyAnnotationMatching (#​1457)
  • Update to Gradle 9.3.1 (#​1458)
  • Update to Error Prone 2.47.0 (#​1461)
  • Switch InvocationAndContext to be a record (#​1463)
  • Upgrade GitHub Actions for Node 24 compatibility by @​salmanmkc (#​1465)
  • Upgrade GitHub Actions to latest versions by @​salmanmkc (#​1466)
  • Bump various dependencies (#​1469)
  • Use text blocks in CustomLibraryModelsTests (#​1482)
  • Update Error Prone and EP plugin (#​1486)
  • Update to Gradle 9.4.0 (#​1491)
  • Minor cleanup, no behavior changes by @​armandino (#​1487)
  • Update to Error Prone 2.49.0 (#​1514)

v0.13.1

Compare Source

• Improve verification of !null -> !null contracts (#​1441)
• Substitute inferred @NonNull types for generic method inference (#​1445)
• Better support for some contracts with boolean argument constraints (#​1447)
• Maintenance
  • Add junit-framework as another integration test (#​1446)

v0.13.0

Compare Source

NullAway now requires a minimum of JDK 17 and Error Prone 2.36.0 to run; we bump the version to 0.13.0 to reflect these
updated requirements. There are also many improvements to JSpecify mode support, and several nice changes and
improvements from first-time contributors.

• Support added for JUnit's @​TempDir by @​romainmoreau (#​1387)
• Use OptimizedLibraryModels for method type variable upper bounds (#​1388)
• Add @​InjectWireMock as known excluded field annotation (#​1391)
• Require JDK 17 to run NullAway (#​1394)
• Support adding nested nullability annotations in library models (#​1407)
• Add library model for AtomicReferenceFieldUpdater (#​1409)
• Correctly get parameter types for a lambda whose type was inferred (#​1348)
• Add Mockito annotations to default excluded field annotations by @​murdos (#​1418)
• Properly identify annotations directly on the array element type of a Symbol (#​1419)
• Update to Checker Framework 3.53.0 (#​1429)
• JSpecify: Apply annotations on type variables to lambdas in more cases (#​1428)
• Migrate AutoValue to Records by @​rishikraj990 (#​1415)
• Bump minimum Error Prone version to 2.36.0, and add detection of nullable dereference by switch expressions (#​1427)
• JSpecify: Improve handling of method references (#​1430)
• Allow suppressing nullaway on individual parameters by @​jackwickham (#​1436)
• Update jdk-javac-plugin to contain nested annotations by @​haewiful (#​1432)
• Maintenance
  • Delete code to generate library models from source (#​1385)
  • Refactor: Migration to Version Catalog completed by @​vitinh0z (#​1386)
  • Bump Gradle to 9.2.1 (#​1392)
  • Update to Error Prone 2.45.0 (#​1401)
  • Stop matching switch expression kind using strings (#​1404)
  • Refactoring: clarify docs and naming for RestoreNullnessAnnotationsVisitor (#​1406)
  • Refactoring: rename method and field (#​1405)
  • Run NullAway on jdk-javac-plugin code (#​1408)
  • Clarify comment in test (#​1411)
  • Enable PatternMatchingInstanceOf check and fix all warnings (#​1412)
  • Enable StatementSwitchToExpressionSwitch check and fix all warnings (#​1413)
  • bump and remove some dependencies (#​1414)
  • Update minimum supported Error Prone version to 2.25.0 (#​1421)
  • Update CI to run builds on JDK 25 (#​1422)
  • Various cleanups suggested by IntelliJ (#​1423)
  • Convert test data in main NullAway tests to use text blocks (#​1424)
  • Refactor CoreTests and UnannotatedTests to use addSourceLines and inline test data by @​cobayo (#​1426)
  • Refactor ContractsTests to use Java text blocks by @​cobayo (#​1435)
  • Update Error Prone and errorprone-plugin versions (#​1434)

v0.12.15

Compare Source

NullAway now includes a BOM artifact com.uber.nullaway:nullaway-bom. Otherwise, this release contains a few bug
fixes and improvements to JSpecify support.

• Fix URL for RequireExplicitNullMarking checker (#​1369)
• Handle annotations on type variables in return and field types (#​1371)
• Change how recursive calls to dataflow are detected (#​1374)
• JSpecify: use type on identifier when its type is a type variable (#​1378)
• Include method type parameters in astubx files. by @​haewiful (#​1370)
• Create nullaway-bom project (#​1130) by @​lpireyn (#​1380)
• Run dataflow analysis on bodies of lambdas passed to generic methods (#​1375)
• Maintenance
  • Remove BaseNoOpHandler and replace with default methods in Handler (#​1376)

v0.12.14

Compare Source

This release fixes a bug where the new RequireExplicitNullMarking check was not fully disabled by default. It also includes a couple of performance optimizations to reduce NullAway overhead.

• Various optimizations (#​1358)
• Don't report matches from RequireExplicitNullMarking when run at SUGGESTION level (#​1365)
• Optimize methods that check for annotations on a Symbol (#​1362)
• Tune warning message for RequireExplicitNullMarking (#​1366)
• Maintenance
  • Fix arg concatenation bug in JMH (#​1357)
  • Move wildcard-related tests to a separate test class (#​1361)

v0.12.13

Compare Source

NullAway now includes a new Error Prone checker, RequireExplicitNullMarking,
that checks that every class is explicitly @NullMarked or @NullUnmarked (at the class or package level), so code
is not left @NullUnmarked unintentionally. The check is disabled by default. See the docs
for further details.

NullAway also includes support for a new @PureExceptLambda annotation, contributed by @​FxMorin, to tell NullAway
to preserve nullability information from the enclosing method when analyzing the body of certain lambdas.
See the docs for details.

• Use passed-in TreePath in one more place when available (#​1329)
• Checker to ensure explicit null marking of every class (#​1323)
• Bound size of alreadyRunAnalyses cache to be consistent (#​1334)
• Improve inference for generic methods with lambda argument containing return statements by @​dhruv-agr (#​1337)
• Add PureExceptLambda annotation by @​FxMorin (#​1325)
• Support marking method type variable upper bounds as @Nullable in library models (#​1345)
• Method name parsing in ExternalStubxLibraryModels class is missing a corner case by @​haewiful (#​1344)
• Better fix for dataflow analysis caching (#​1353)
• Maintenance
  • Add package-info files with @​NullMarked (#​1331)
  • Speed up buildWithNullAway task (#​1330)
  • Enable the VoidMissingNullable checker and autofix all extant warnings (#​1332)
  • Bump JDK version to 25 for integration tests (#​1336)
  • Switch Coderabbit to assertive mode (#​1338)
  • Enable EqualsMissingNullable check and fix all extant warnings (#​1339)
  • Bump to AutoValue 1.11.1 (#​1340)
  • Update Caffeine benchmark (#​1342)
  • Add a test for a useless @​Contract (#​1346)
  • Test case for wildcards in Generic Method with Lambda Arguments by @​dhruv-agr (#​1349)
  • Add initial AGENTS.md file (#​1352)

v0.12.12

Compare Source

This release fixes a severe performance regression introduced in NullAway 0.12.11 and we encourage all users of 0.12.11 to upgrade.

• Address severe performance regression in dataflow analysis (#​1328)
• Maintenance
  • Fix test args for SuggestedFixesTests (#​1324)
  • Stop passing -processorpath to CompilationTestHelper in NullAway tests (#​1326)

v0.12.11

Compare Source

In this release, NullAway checks the requirement that JSpecify mode is only run on a compatible javac version /
configuration, and fails if it detects an incompatibility.
See https://github.com/uber/NullAway/wiki/JSpecify-Support#supported-jdk-versions for details.

• Use inference for generic call passed as receiver to instance method (#​1293)
• Accept any annotation with simple name Contract, and change reporting of invalid contract annotations (#​1295)
• Properly model AtomicReference.get() in JSpecify mode (#​1298)
• Improve handling and error messages when using this inside an anonymous class (#​1305)
• Generate astubx from JSON output of jdk-javac-plugin by @​haewiful (#​1243)
• Improve inference for generic method with void-returning lambda argument by @​dhruv-agr (#​1312)
• Use refined types from dataflow analysis in generic method inference (#​1309)
• Fail if NullAway is run in JSpecify mode with an incompatible javac version / configuration (#​1317)
• Jdk javac plugin: don't serialize info for classes / methods without annotations by @​haewiful (#​1316)
• Maintenance
  • [Cleanup] Refactor away unnecessary Predicate by @​lazaroclapp (#​1297)
  • Update to Error Prone 2.42.0 (#​1299)
  • Update to Gradle 9.1.0 (#​1302)
  • Test on JDK 25 (#​1301)
  • Compile with JDK 25 (#​1303)
  • Add CodeRabbit config (#​1306)
  • Update Gradle command used for integration tests (#​1311)
  • Disable CodeRabbit review status comments (#​1313)
  • Gradle fixes for jar-infer-lib (#​1314)
  • Enable building NullAway on JDK 25 (#​1315)

v0.12.10

Compare Source

This release contains significant improvements to inference support for generic method calls in JSpecify mode (#​1075).
We expect that many more valid calls will pass NullAway, but that some new bugs may have been introduced. Please report
any issues that you see. There is also a new flag, -XepOpt:NullAway:WarnOnGenericInferenceFailure to make NullAway
report a warning when inference fails, to help identify any issues.

• Improved inference for generic method calls (#​1244)
• Suppress CastToNonNull warnings for @NullUnmarked method calls by @​raccoonback (#​1258)
• JSpecify: Fix crash when overriding with raw types (#​1265)
• Better handle calls to super constructors and superclass methods in JSpecify mode (#​1248)
• issue-1250 pattern matching for instanceof in switch case by @​dhruv-agr (#​1259)
• Account for annotations in extends / implements when computing view as supertype (#​1266)
• Bug fix with type substitutions after inference (#​1277)
• JSpecify: Improve error messages for type incompatibility at pseudo-assignments (#​1279)
• Support java.util.Objects.toString() by @​gulikoza (#​1283)
• Record when generic method inference fails (#​1280)
• issue 1275 - report unboxing warning for for-each loop by @​dhruv-agr (#​1281)
• Abstract iterating over invocation arguments (#​1284)
• Invoke generic method inference in more places (#​1286)
• Maintenance
  • Build Spring with snapshot build as a CI job (#​1251)
  • Add more instance fields to GenericsChecks (#​1256)
  • remove unneeded checkNotCall call (#​1257)
  • Fail build on JDK 21 versions before 21.0.8 (#​1261)
  • Clarify JDK version to use for best JSpecify support (#​1269)
  • Simplified set of CI jobs (#​1271)
  • Build: upgrade to Gradle 9 + AGP 8.7.2 (#​1270)
  • Compile with JDK 24 (#​1276)
  • Don't use deprecated buildDir by @​mernst (#​1278)

v0.12.9

Compare Source

• Add a case in our inference for generic method calls (#​1240)
• Add library model for Apache Commons CollectionUtils.isNotEmpty, Amazon CollectionUtils.IsNullOrEmpty, and a couple Amazon StringUtils methods (#​1242)
• Maintenance
  • Fix maven central link in RELEASING.md (#​1237)
  • Update to Error Prone 2.41.0 (#​1239)
  • Add tests for gh-1246 (#​1247)
  • Test reading JSpecify annotations from bytecodes on JDK 21 (#​1245)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud