[dependabot]

Bumps com.uber.nullaway:nullaway from 0.13.8 to 0.14.3.

Release notes

Sourced from com.uber.nullaway:nullaway's releases.

NullAway 0.14.3

Many bug fixes in this release. Thanks especially to @​vlsi and @​subhramit for all the contributions! As they are now committers, their many contributions are not credited individually below.

Two bug fixes of note are #2005 and #2003, which may lead to new warnings even outside JSpecify mode.

We have also added initial support for @PolyNull in library models in #1813. We will continue to enhance this support, but it should be helpful in removing some false positives from JSpecifyExperimental mode.

• Allow configuring suppression-remover source encoding (#1894)
• Compute a call's executable type once per generic inference by @​ericschlarmann (#1896)
• Skip nested annotation restoration from raw source types (#1898)
• Refine argument nullness after Objects.equals calls by @​Beluomini (#1900)
• Keep nullable map values nullable after containsKey (#1902)
• Read nullable fields from JSpecify JDK models into astubx (#1901)
• Avoid initialization-check crashes in @NullMarked constructors by @​ZedingZhang (#1929)
• Store types of implicit lambda parameters during inference (#1930)
• Compute erasure before binary promotion (#1935)
• Preserve captured type variables during constraint generation (#1941)
• Cache conversion of MethodSymbols to MethodRefs (#1964)
• Restore nullness annotations from implicit wildcard bounds (#1967)
• Use call-specific generic inference variables (#1965)
• Account for nullable map values in getOrDefault (#1985)
• Fix crash in map callbacks after an unmarked or suppressed filter predicate (#1996)
• Strip reference casts when computing access paths (#1997)
• Handle negated null checks in multi-argument boolean contracts (#1998)
• Skip parentheses around a lambda or method reference passed to unmarked code (#1999)
• Fix crash on method references to annotated array types (#2000)
• Skip a lower-bounded wildcard when restoring annotations on a call type (#2001)
• Strip parentheses before handlers match stream callbacks and boolean literals (#2002)
• Check explicitly typed lambda parameters against unmarked interface methods (#2003)
• Add PolyNull library models and apply them to Optional.orElseGet and Map.computeIfAbsent (#1813)
• Report unboxing of a @​Nullable operand inside a primitive conditional expression (#2005)
• Report unboxing of a @​Nullable result inside a primitive switch expression (#2006)
• Fix crash on null-marked code nested in unmarked lambdas and local classes (#2007)
• Strip parentheses before the futures and gRPC handlers match an argument (#2010)
• Recognize boolean constants behind a cast in EnsuresNonNullIf and stream filters (#2011)
• Treat a parenthesized lambda or method reference like an unwrapped one in generics checks (#2012)
• Recognize a cast null check in a boolean contract argument (#2013)
• Keep the access path of a map key, call argument, or array index cast to its own type (#2014)
• Check nested nullness of explicitly typed lambda parameters (#2015)
• Keep distinct constant map keys and call arguments on distinct access paths (#2016)
• Apply conditional library return models to method references (#1968)
• Reject conflicting fixed parameter models regardless of PolyNull (#2025)
• Keep the boxing wrapper in the identity of a variable map key (#2017)
• Maintenance
  • Report diff coverage after each test run, quoting the changed lines the run did not execute and the branches it took one way, and writing the whole report to <module>/build/reports/diff-coverage/test.txt; a // diff-coverage: ignore comment moves a line out of that list without changing the counts (#1833)

... (truncated)

Changelog

Sourced from com.uber.nullaway:nullaway's changelog.

Version 0.14.3

Many bug fixes in this release. Thanks especially to @​vlsi and @​subhramit for all the contributions! As they are now committers, their many contributions are not credited individually below.

Two bug fixes of note are #2005 and #2003, which may lead to new warnings even outside JSpecify mode.

We have also added initial support for @PolyNull in library models in #1813. We will continue to enhance this support, but it should be helpful in removing some false positives from JSpecifyExperimental mode.

• Allow configuring suppression-remover source encoding (#1894)
• Compute a call's executable type once per generic inference by @​ericschlarmann (#1896)
• Skip nested annotation restoration from raw source types (#1898)
• Refine argument nullness after Objects.equals calls by @​Beluomini (#1900)
• Keep nullable map values nullable after containsKey (#1902)
• Read nullable fields from JSpecify JDK models into astubx (#1901)
• Avoid initialization-check crashes in @NullMarked constructors by @​ZedingZhang (#1929)
• Store types of implicit lambda parameters during inference (#1930)
• Compute erasure before binary promotion (#1935)
• Preserve captured type variables during constraint generation (#1941)
• Cache conversion of MethodSymbols to MethodRefs (#1964)
• Restore nullness annotations from implicit wildcard bounds (#1967)
• Use call-specific generic inference variables (#1965)
• Account for nullable map values in getOrDefault (#1985)
• Fix crash in map callbacks after an unmarked or suppressed filter predicate (#1996)
• Strip reference casts when computing access paths (#1997)
• Handle negated null checks in multi-argument boolean contracts (#1998)
• Skip parentheses around a lambda or method reference passed to unmarked code (#1999)
• Fix crash on method references to annotated array types (#2000)
• Skip a lower-bounded wildcard when restoring annotations on a call type (#2001)
• Strip parentheses before handlers match stream callbacks and boolean literals (#2002)
• Check explicitly typed lambda parameters against unmarked interface methods (#2003)
• Add PolyNull library models and apply them to Optional.orElseGet and Map.computeIfAbsent (#1813)
• Report unboxing of a @​Nullable operand inside a primitive conditional expression (#2005)
• Report unboxing of a @​Nullable result inside a primitive switch expression (#2006)
• Fix crash on null-marked code nested in unmarked lambdas and local classes (#2007)
• Strip parentheses before the futures and gRPC handlers match an argument (#2010)
• Recognize boolean constants behind a cast in EnsuresNonNullIf and stream filters (#2011)
• Treat a parenthesized lambda or method reference like an unwrapped one in generics checks (#2012)
• Recognize a cast null check in a boolean contract argument (#2013)
• Keep the access path of a map key, call argument, or array index cast to its own type (#2014)
• Check nested nullness of explicitly typed lambda parameters (#2015)
• Keep distinct constant map keys and call arguments on distinct access paths (#2016)
• Apply conditional library return models to method references (#1968)
• Reject conflicting fixed parameter models regardless of PolyNull (#2025)
• Keep the boxing wrapper in the identity of a variable map key (#2017)

... (truncated)

Commits

• 4b19c42 Prepare for release 0.14.3.
• e91ea4b Keep the boxing wrapper in the identity of a variable map key (#2017)
• d9cd573 Enable zizmor job for merge queue (#2039)
• 7f85800 Reject conflicting fixed parameter models regardless of PolyNull (#2025)
• ef0ddbd Build third-party projects at pinned commits with patches until upstream merg...
• 3035507 Apply conditional library return models to method references (#1968)
• 5023d67 Pin oracle-actions/setup-java to the v1.5.0 tag (#2021)
• 9555b20 Keep distinct constant map keys and call arguments on distinct access paths (...
• 29b740d Check nested nullness of explicitly typed lambda parameters (#2015)
• 10606a3 Keep the access path of a map key, call argument, or array index cast to its ...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies, java. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None